CVE-2026-53366

The vulnerability originates from an incorrect calculation of allocation lengths in the IPv4 packet handling routine __ip_append_data() when the paged allocation path is used, corresponding to CWE‑131 (Incorrect Calculation of Buffer Size). Because the fraggap bytes are not accounted for properly, the subsequent copy operation may access a memory region that is larger or smaller than the allocated buffer, leading to a buffer overflow or underflow. This mismatch can corrupt kernel memory, potentially causing a kernel panic or, if an attacker manages to craft a packet that triggers the exploit, may be leveraged for privilege escalation. The impact is therefore memory corruption at the kernel level, which could result in a crash or unintended privilege escalation.

All Linux kernel builds that include the __ip_append_data() implementation are affected, as indicated by the generic Linux kernel CPE. The CPE list also references Red Hat Enterprise Linux 10.2 and 10.0 EUS, indicating that those releases are included among the vulnerable systems. The absence of a specific version range in the CVE data implies that every kernel version prior to the patch that corrects the fraggap accounting is impacted.

The EPSS score of less than 1% indicates a very low likelihood of public exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.8 indicates strong potential for significant impact if the flaw is exploited. The likely attack vector is network‑based, requiring an attacker to send a specially crafted IPv4 packet processed by the kernel’s networking stack. The complexity of creating a packet that precisely triggers the miscalculation may limit exploitation, but the potential for a kernel crash or privilege escalation remains significant.