CVE-2026-53362 - Vulnerability Details

- ipv6: account for fraggap on the paged allocation path

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: account for fraggap on the paged allocation path

In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as

alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;

datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.

An unprivileged user can trigger this via a UDPv6 socket using
MSG_MORE together with MSG_SPLICE_PAGES.

The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:
avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix
__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative
copy value caused -EINVAL to be returned. That later commit allowed
MSG_SPLICE_PAGES to proceed in this case, making the corruption
triggerable.

The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.

After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES
case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

Published: 2026-07-04

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw exists in the Linux kernel’s IPv6 stack within the __ip6_append_data() function. When the paged‑allocation path is used, the linear buffer is sized too small and the paged buffer too large because fragment gaps (fraggap) are not properly accounted for. This mismatch causes a write past skb->end into the skb_shared_info structure, corrupting kernel memory and potentially leading to a crash or denial of service.

Affected Systems

The vulnerability impacts any kernel IPv6 implementation that has not incorporated the fix introduced by commit ce650a166335. All kernel releases preceding that commit are vulnerable unless a backport or downstream patch is applied.

Risk and Exploitability

Exploitation requires only local access; any user who can open a UDPv6 socket MSG_MORE and MSG_SPLICE_PAGES flags simultaneously. The EPSS score is under 1 % and the vulnerability is not listed in CISA KEV, indicating a low probability of widespread exploitation. The CVSS score of 7.8 reflects a high risk of a local out‑of‑bounds write that could result in denial of service or kernel crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`773ba4fe9104a64a54d1c00f0fb6ffb95def2b03`	affected	< 14200d435af9a9eeb444f529fc2f689a236b7962
`773ba4fe9104a64a54d1c00f0fb6ffb95def2b03`	affected	< 65fb14cbebb0cd0eff903a22d33537ddc8b95769
`773ba4fe9104a64a54d1c00f0fb6ffb95def2b03`	affected	< 46f201f8b4c39633a1fa3dc12459f506d470993d
`773ba4fe9104a64a54d1c00f0fb6ffb95def2b03`	affected	< 6374fb9edf72c67a118a2c214a0dddd04c921e0a
`773ba4fe9104a64a54d1c00f0fb6ffb95def2b03`	affected	< e9eacf19281ea2498b36291b56c9606118c2d74e
`773ba4fe9104a64a54d1c00f0fb6ffb95def2b03`	affected	< 736b380e28d0480c7bc3e022f1950f31fe53a7c5

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[773ba4fe9104a64a54d1c00f0fb6ffb95def2b03,14200d435af9a9eeb444f529fc2f689a236b7962)`	affected	code_commit	—
`[773ba4fe9104a64a54d1c00f0fb6ffb95def2b03,65fb14cbebb0cd0eff903a22d33537ddc8b95769)`	affected	code_commit	—
`[773ba4fe9104a64a54d1c00f0fb6ffb95def2b03,46f201f8b4c39633a1fa3dc12459f506d470993d)`	affected	code_commit	—
`[773ba4fe9104a64a54d1c00f0fb6ffb95def2b03,6374fb9edf72c67a118a2c214a0dddd04c921e0a)`	affected	code_commit	—
`[773ba4fe9104a64a54d1c00f0fb6ffb95def2b03,e9eacf19281ea2498b36291b56c9606118c2d74e)`	affected	code_commit	—
`[773ba4fe9104a64a54d1c00f0fb6ffb95def2b03,736b380e28d0480c7bc3e022f1950f31fe53a7c5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	generic	—
`[0,6.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains commit ce650a166335 or a later downstream fix.
Modify services to ensure that no UDPv6 socket is created with both MSG_MORE and MSG_SPLICE_PAGES flags simultaneously.
If an immediate kernel upgrade is not possible, enable kernel hardening features such as KASLR, restrict socket buffer allocations, and enforce tighter memory protection of any memory corruption.

Generated by OpenCVE AI on July 22, 2026 at 13:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4688-1	linux security update
Debian DSA	DSA-6381-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00221.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962
https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d
https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a
https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769
https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5
https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e
https://lore.kernel.org/linux-cve-announce/2026070450-CVE-2026-53362-fe9b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53362
https://www.cve.org/CVERecord?id=CVE-2026-53362

History

Sat, 18 Jul 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mon, 06 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-131
References		https://lore.kernel.org/linux-cve-announce/2026070450-CVE-2026-53362-fe9b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53362 https://www.cve.org/CVERecord?id=CVE-2026-53362
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Mon, 06 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-787

Mon, 06 Jul 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-787

Sun, 05 Jul 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-787

Sun, 05 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-787

Sat, 04 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
Title		ipv6: account for fraggap on the paged allocation path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962 https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769 https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5 https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-04T11:56:35.864Z

Updated: 2026-07-18T07:33:31.678Z

Reserved: 2026-06-09T07:44:35.400Z

Link: CVE-2026-53362

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-07-04T00:00:00Z

Links: CVE-2026-53362 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-22T13:15:12Z

Weaknesses

CWE-131
Incorrect Calculation of Buffer Size

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object