CVE-2026-53362 Linux Kernel Unspecified
An unprivileged user can trigger memory corruption in the Linux kernel IPv6 stack via UDPv6 sockets, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Since 27 Aug 2026
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53362?
CVE-2026-53362 is a high-severity memory corruption vulnerability in Linux kernel, published on 4 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as
alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info.
An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES.
The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable.
The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen.
After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
Which versions are affected by CVE-2026-53362?
It affects 2 products.
Products include Linux kernel, Siemens Simatic S7-1500 Tm Mfp Firmware.
How do I fix CVE-2026-53362?
Apply the vendor's patch. US federal agencies must fix it by 30 Aug 2026.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53362 being exploited?
Yes. Attackers have exploited CVE-2026-53362 in the wild since at least 27 Aug 2026.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-92007, BELL-CVE-2026-53362, DEBIAN-CVE-2026-53362, GHSA-3x6f-vm7x-cgm7, ROOT-OS-DEBIAN-12-CVE-2026-53362, ROOT-OS-UBUNTU-2404-CVE-2026-53362 and 1 more.