Skip to content
Fencer Vulns
high 7.8

CVE-2026-53362 kev in the critical feed json

ipv6: account for fraggap on the paged allocation path

published 2026-07-04 4 mo ago modified 2026-10-15 25 d ago also EUVD-2026-41669

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2026-08-27
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

ipv6: account for fraggap on the paged allocation path

In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as

alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;

datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info.

An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES.

The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable.

The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen.

After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

Patch / fix

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

  • Linux Linux 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2
  • linux Debian 12 6.1.177-1
  • linux Debian 13 6.12.95-1
  • linux Debian 14 7.1.3-1

debian advisories DEBIAN-CVE-2026-53362

  • linux Ubuntu 24.04 LTS 6.8.0-147.147
  • linux Ubuntu 26.04 LTS 7.0.0-31.31
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1067.70
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1012.12
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1071.79
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1011.11
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1066.74
  • linux-gke Ubuntu 26.04 LTS 7.0.0-1006.7

ubuntu advisories UBUNTU-CVE-2026-53362

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kpatch-patch-6_12_0-211_16_1 RHEL 10.2 1-4.el10_2
  • kernel RHEL 10.2 6.12.0-211.30.1.el10_2
  • rv RHEL 10.2 6.12.0-211.30.1.el10_2
  • perf RHEL 10.2 6.12.0-211.30.1.el10_2
  • rtla RHEL 10.2 6.12.0-211.30.1.el10_2
  • libperf RHEL 10.2 6.12.0-211.30.1.el10_2
  • kernel-rt RHEL 10.2 6.12.0-211.30.1.el10_2
  • kernel-64k RHEL 10.2 6.12.0-211.30.1.el10_2

red hat advisories RHSA-2026:43826RHSA-2026:34911

  • kernel-livepatch-MICRO-6-0-RT_Update_13 Linux Micro 6.1, Linux Micro 6.0 9-1.1
  • kernel-livepatch-MICRO-6-0-RT_Update_25 Linux Micro 6.1, Linux Micro 6.0 2-1.1
  • kernel-livepatch-MICRO-6-0_Update_25 Linux Micro 6.1, Linux Micro 6.0 2-1.1
  • kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-50.2
  • kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-50.1
  • kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-50.1
  • kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-50.1
  • kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-50.2

suse advisories SUSE-SU-2026:22689-1SUSE-SU-2026:22711-1SUSE-SU-2026:23031-1SUSE-SU-2026:23100-1SUSE-SU-2026:23010-1SUSE-SU-2026:23079-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.36.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.36.1

opensuse advisories openSUSE-SU-2026:21388-1openSUSE-SU-2026:11214-1

  • kernel Azure Linux 3.0 6.6.144.1-1

azure linux advisories AZL-92007

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-53362 updated cvss 7.8

kernel: kernel: ipv6 frag escape

  • Red Hat NVIDIA for RHEL 10 rv 6.12.0-231.14.el10nv, perf 6.12.0-231.14.el10nv, rtla 6.12.0-231.14.el10nv, kernel 6.12.0-231.14.el10nv, kernel-64k 6.12.0-231.14.el10nv, kernel-core 6.12.0-231.14.el10nv, +25 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:34927
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.30.1.el10_2, perf 6.12.0-211.30.1.el10_2, rtla 6.12.0-211.30.1.el10_2, python3-perf 6.12.0-211.30.1.el10_2, kernel-devel-matched 6.12.0-211.30.1.el10_2, kernel-64k-devel-matched 6.12.0-211.30.1.el10_2, +7 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:34911
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rv 6.12.0-55.86.1.el10_0, perf 6.12.0-55.86.1.el10_0, rtla 6.12.0-55.86.1.el10_0, python3-perf 6.12.0-55.86.1.el10_0, kernel-devel-matched 6.12.0-55.86.1.el10_0, kernel-64k-devel-matched 6.12.0-55.86.1.el10_0, +7 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:35840
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.30.1.el10_2, kernel-64k 6.12.0-211.30.1.el10_2, kernel-core 6.12.0-211.30.1.el10_2, kernel-tools 6.12.0-211.30.1.el10_2, kernel-modules 6.12.0-211.30.1.el10_2, kernel-64k-core 6.12.0-211.30.1.el10_2, +29 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:34911
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel 6.12.0-55.86.1.el10_0, kernel-64k 6.12.0-55.86.1.el10_0, kernel-core 6.12.0-55.86.1.el10_0, kernel-tools 6.12.0-55.86.1.el10_0, kernel-modules 6.12.0-55.86.1.el10_0, kernel-64k-core 6.12.0-55.86.1.el10_0, +27 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:35840
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.30.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.30.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.30.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.30.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.30.1.el10_2
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:34911
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libperf 6.12.0-55.86.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.86.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.86.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.86.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.86.1.el10_0
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:35840
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.30.1.el10_2, kernel-rt-64k 6.12.0-211.30.1.el10_2, kernel-rt-core 6.12.0-211.30.1.el10_2, kernel-rt-modules 6.12.0-211.30.1.el10_2, kernel-rt-64k-core 6.12.0-211.30.1.el10_2, kernel-rt-debug-core 6.12.0-211.30.1.el10_2, +14 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:34911
show 4 more
  • Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt 6.12.0-55.86.1.el10_0, kernel-rt-64k 6.12.0-55.86.1.el10_0, kernel-rt-core 6.12.0-55.86.1.el10_0, kernel-rt-modules 6.12.0-55.86.1.el10_0, kernel-rt-64k-core 6.12.0-55.86.1.el10_0, kernel-rt-debug-core 6.12.0-55.86.1.el10_0, +14 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:35840
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.30.1.el10_2, kernel-rt-core 6.12.0-211.30.1.el10_2, kernel-rt-modules 6.12.0-211.30.1.el10_2, kernel-rt-debug-core 6.12.0-211.30.1.el10_2, kernel-rt-modules-core 6.12.0-211.30.1.el10_2, kernel-rt-debug-modules 6.12.0-211.30.1.el10_2, +4 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:34911
  • Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt 6.12.0-55.86.1.el10_0, kernel-rt-kvm 6.12.0-55.86.1.el10_0, kernel-rt-core 6.12.0-55.86.1.el10_0, kernel-rt-modules 6.12.0-55.86.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.86.1.el10_0, kernel-rt-debug-core 6.12.0-55.86.1.el10_0, +6 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:35840
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-295-16 updated cvss 7.8

Siemens SIMATIC S7-1500 TM MFP

  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA SSVC: exploitation active
  4. CISA patch deadline

Known exploited

Added
2 mo ago
Patch by
2026-08-30 (2 mo ago)
Ransomware
Not known
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor, product
Linux, Kernel
CISA name
Linux Kernel Unspecified Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.