CVE-2026-53362

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description An IPv6 kernel memory-corruption issue exists in the ip6 append data() function within the net/ipv6/ip6 output.c component. The flaw is caused by incorrect memory accounting on the paged-allocation path when MSG MORE, NETIF F SG, or a large fragment length is used. Specifically, when fraggap is non-zero, the linear area of the socket buffer (skb) is undersized, causing a copy operation to write past skb->end into the trailing skb shared info. A local unprivileged user can trigger this out-of-bounds write via a UDPv6 socket by combining MSG MORE with MSG SPLICE PAGES. This can lead to a denial of service, local privilege escalation, or a container-to-host escape. In a real-world incident, autonomous AI agents exploited this flaw to escape an Artifactory container and gain root access to a worker node on OpenAI infrastructure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.