---
schema: 1
kind: vulnerability
title: "Linux kernel IPv6 UDP fraggap accounting bug (CVE-2026-53362) added to CISA KEV — an unprivileged local heap overflow via MSG_SPLICE_PAGES, no exploitation narrative published"
headline: "A confirmed-exploited Linux kernel local privilege-escalation primitive with no public account of how it is being used"
summary: >
  CISA added CVE-2026-53362 to KEV on 2026-08-27. In __ip6_append_data()'s paged-allocation
  branch, accounting fails to account for a non-zero fraggap carried over from a previous skb,
  undersizing a linear allocation and writing past skb->end. An unprivileged user can trigger it
  via a UDPv6 socket using MSG_MORE with MSG_SPLICE_PAGES. CVSS 7.8, local-only. No exploitation
  narrative, named cluster or affected-distribution list has been located (as of 2026-08-28) beyond the KEV listing
  and the upstream kernel fix commit itself.
discovered_at: "2026-08-28T06:02:00Z"
updated_at: null
event_date: "2026-08-27"
run_id: 2026-08-28T0409Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, priv-esc, cisa-kev, actively-exploited]
regions: [global]
sectors: [public-sector, energy, water, transport, healthcare, finance, telco]
entities: []
techniques: [T1068]
affected_products: ["Linux kernel"]
cves:
  - id: CVE-2026-53362
    cvss: "7.8"
    epss: null
    type: memory-corruption
    vector: local
    auth: post-auth
    status: [exploited, cisa-kev]
    affected: "Linux kernel versions carrying the affected __ip6_append_data() accounting logic — no version-specific list published"
    fixed: "Upstream kernel stable-tree fix; pending distribution backport"
sources:
  - url: "https://git.kernel.org/stable/c/14200d435af9"
    publisher: "Linux kernel stable tree (upstream fix commit)"
    date: "2026-08-27"
    role: primary
  - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
    publisher: "CISA Known Exploited Vulnerabilities Catalog (JSON feed)"
    date: "2026-08-27"
    role: primary
closed_sources: []
evidence:
  - quote: "An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES."
    publisher: "Linux kernel stable tree (upstream fix commit)"
verification: multi-source
sourcing_note: >
  The technical mechanism is confirmed directly against the upstream kernel-tree fix commit
  message; the CISA KEV listing is the independent confirmation of active exploitation. No
  exploitation narrative, named cluster, or affected-distribution list was located beyond these
  two primaries — treated as confirmed-exploited per CISA's determination, with the mechanism
  confirmed but the "who/how" of exploitation unstated by any source located as of 2026-08-30.
confidence: medium
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Apply the distribution kernel update carrying this stable-tree fix as soon as it is available for every running Linux distribution — CISA's KEV listing confirms active exploitation, and there is no practical configuration-level workaround short of restricting untrusted local users' ability to open raw UDPv6 sockets with MSG_SPLICE_PAGES-capable applications."
updates:
  - at: "2026-08-28T15:00:00Z"
    run_id: 2026-08-28T1500Z-audit
    type: improvement
    internal: true
    summary: >
      Operator-directed editorial pass (v4.2): removed composition-rationale narration and 
      pipeline-internal jargon from reader-facing text; tightened or cut paragraphs that 
      restated the summary or padded without responder value. No factual claim changed.
    fields: [summary, body]
  - at: "2026-08-30T13:12:06Z"
    run_id: 2026-08-30T1312Z-audit
    type: correction
    summary: >
      The CVE record said pre-auth while the entry's own quoted CVSS vector says otherwise. The
      vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: local attack vector, low privileges
      required, meaning an unprivileged local user who can already open a UDPv6 socket, not an
      unauthenticated actor. Corrected to post-auth. This narrows who can reach the flaw but not
      its severity: the KEV listing and the local privilege-escalation impact are unchanged, and
      on a multi-tenant or shell-accessible host the prerequisite is trivially met.
    fields: [cves, sourcing_note, body]
migrated_from: null
---

CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 2026-08-27. In `__ip6_append_data()`'s paged-allocation branch — taken under `MSG_MORE` / `NETIF_F_SG` / large-fraglen conditions — `alloclen` and `pagedlen` accounting fail to account for a non-zero "fraggap" carried over from a previous skb once `transhdrlen` is zero, undersizing the linear allocation while overstating `pagedlen`, so the fraggap-copy step writes past `skb->end` into the trailing `skb_shared_info`. The upstream fix commit states the trigger directly: "an unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES" ([Linux kernel stable-tree fix commit, 2026-08-27](https://git.kernel.org/stable/c/14200d435af9)). The bad accounting was introduced by an earlier commit ("ipv6: avoid partial copy for zc") and only became reachable once a later commit allowed `MSG_SPLICE_PAGES` to proceed in the negative-copy case that previously returned `-EINVAL`. CVSS 3.1 7.8 (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`).

As of 2026-08-28, no public exploitation narrative, named cluster, or affected-distribution list has been located beyond the KEV/EUVD listing and the upstream kernel commit itself; the flaw is confirmed-exploited per CISA's determination, with the mechanism confirmed against the kernel-tree commit. A local, unprivileged-to-elevated primitive requires an attacker to already hold unprivileged local code execution — exactly the scenario a confirmed kernel LPE turns into full compromise.

Because this affects any Linux kernel exposing an unprivileged user to socket operations — effectively all general-purpose Linux deployments pending distribution backport — the patch lever is the standing kernel-update cycle rather than a configuration change. **Triage:** none is offered beyond the patch action itself; with no published exploitation narrative, inventing a specific hunting query for this primitive would exceed what the cited sources support. The one available lever short of a distribution backport is restricting which local users or containers can open raw UDPv6 sockets with `MSG_SPLICE_PAGES`-capable applications, which is not a practical general control for most estates.

## Correction — 2026-08-30T13:12:06Z

This CVE was recorded as pre-auth, which contradicts the CVSS vector the entry itself quotes: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8. PR:L means the attacker must already hold an unprivileged local account, and the trigger is a local user opening a UDPv6 socket with MSG_MORE and MSG_SPLICE_PAGES set together ([upstream kernel fix commit `14200d43`](https://github.com/gregkh/linux/commit/14200d43)). It is a local privilege-escalation primitive, not a remotely reachable one. For scoping, that puts the exposure on hosts where untrusted code already runs, containers, shared shells, CI runners and multi-tenant systems, rather than on the network perimeter.