Is CVE-2026-53362 being actively exploited?

Yes — CVE-2026-53362 is in CISA's Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch affected products as a priority.

What products does CVE-2026-53362 affect?

Tracked products affected include Linux Kernel. Check the version you run to see whether it is affected.

How do I fix CVE-2026-53362?

This vulnerability is being actively exploited in the wild — patch affected products urgently. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2026-53362

Q: What is CVE-2026-53362?

CVE-2026-53362 is a high-severity software vulnerability (Out-of-bounds write) with a CVSS score of 7.8. In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen

HIGH severity · CVSS 7.8 · Out-of-bounds write · actively exploited (CISA KEV)

7.8CVSS HIGH exploited

Actively exploited in the wild (CISA Known Exploited Vulnerabilities). Added to KEV 2026-08-27. US federal agencies must patch by 2026-08-30.

Summary

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

Impact & exploitability

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)1%

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Linux Kernel

Recommendation

This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.

Official patch: https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962 ↗

CVE-2026-53362

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information