Linux kernel memory corruption exploited (CVE-2026-53362)

Actively exploited in the wild - CVE-2026-53362 is a high-severity memory corruption vulnerability in the Linux kernel’s IPv6 append-data path that lets unprivileged local users escalate privileges to root. The flaw affects kernel versions from 5.10 through 6.8 and has been confirmed as exploited in active attacks; patch your kernel now.

Overview

CVE-2026-53362 is a heap out-of-bounds write in the Linux kernel’s __ip6_append_data() function, which handles UDPv6 packet assembly. The bug stems from incorrect accounting of “fraggap” bytes - the padding inserted between fragments when a packet exceeds the path MTU. On the paged-allocation branch (triggered when MSG_MORE is set together with MSG_SPLICE_PAGES), the kernel allocates a linear buffer that is undersized by the fraggap amount, then copies data past the end of the skb into the trailing skb_shared_info structure.

An unprivileged user can trigger this condition by opening a UDPv6 socket and sending fragmented data with the combination of MSG_MORE and MSG_SPLICE_PAGES flags. The resulting out-of-bounds write corrupts kernel heap memory, which can be leveraged to achieve arbitrary code execution with kernel privileges.

The vulnerability was introduced in commit 773ba4fe9104 and became exploitable after commit ce650a166335 relaxed a check that previously returned -EINVAL for this code path. A CVSS score of 7.8 (HIGH) reflects the local attack vector, low complexity, and the fact that no user interaction is required beyond triggering the packet send.

Affected Systems

All Linux kernel versions from 5.10 through 6.8 are vulnerable. Major distributions including Ubuntu, Debian, RHEL, and SUSE have all shipped affected kernels in this range. Systems running UDPv6 services are at risk, but the vulnerability is exploitable from any unprivileged process with socket access.

Remediation

Update your kernel package to a patched version immediately. Kernel 6.8.5 and later contain the fix. Distribution-specific patches are available:

• Ubuntu: linux-image packages 5.15.0-105 or later
• Debian: linux package 6.1.90-1 or later
• RHEL/CentOS: kernel-5.14.0-427.13.1 or later

If immediate patching is not possible, mitigate by blocking unprivileged access to UDPv6 sockets via seccomp or by disabling IPv6 entirely on systems that do not require it.

Security Insight

This bug follows a pattern of subtle memory-accounting errors in network stack code that remain dormant for years until a later refactor removes an incidental safety check. The original -EINVAL return was never a deliberate security boundary, but it happened to prevent exploitation. When that guard was lifted for legitimate functionality, the latent flaw became weaponizable. This underscores how fragile incidental protections are - security teams should audit code paths where error returns are relaxed or removed, as each one can expose latent memory corruption bugs. For related analysis of actively exploited Linux kernel flaws, see our coverage of CVE-2026-31431 and the CrackArmor AppArmor series, plus this week’s threat roundup.

Further Reading

• Weekly Threat Roundup: Apache & cPanel Zero-Days (Apr 27 - May 3)
• CISA Adds Actively Exploited Linux Root Bug CVE-2026-31
• Nine CrackArmor Flaws in Linux AppArmor Enable Root
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs