CVE-2026-53362: Linux Kernel Unspecified Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 27 Aug 2026, 54 days after the CVE record was published.

How likely is exploitation in the next 30 days?

0.7%

EPSS score, percentile 53.4 of all scored records

How severe?

7.8 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA deadline 30 Aug 2026. Apply mitigations in accordance with vendor instructions … Full text

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

• 6.0

Unaffected before 6.0; 6.1.177; 6.6.144; 6.12.95; 6.18.38; 7.1.3; and 1 more

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

CISA due date for this action: 30 August 2026.

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

• https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962
• https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769
• https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d
• https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a
• https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e
• https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5

Affected products and versions

As listed in the CVE record.

Versions not listed are: unaffected.

Versions not listed are: affected.

Versions the record lists as unaffected: 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

• CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities (KEV) catalog on 27 Aug 2026.
• CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
• The due date CISA sets for the required action is 30 Aug 2026.
• The CVE record was published on 4 Jul 2026, 54 days before it was added to KEV.
• The CVE record carries a CVSS v3.1 base score of 7.8 (High), given by its CNA.
• FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.7% (percentile 53.4), as of 28 Oct 2026.
• CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

ipv6: account for fraggap on the paged allocation path

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

• CWE-122: Heap-based Buffer Overflow

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

References

• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org

More exploited Linux vulnerabilities

• CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability (added 28 Oct 2026)
• CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (added 18 Sep 2026)
• CVE-2025-39964: Linux Kernel Race Condition Vulnerability (added 18 Sep 2026)
• CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability (added 18 Sep 2026)
• CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability (added 26 Aug 2026)
• CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability (added 2 Jun 2026)