CVE-2026-53362

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description An IPv6 kernel memory-corruption issue exists in the ip6 append data() function within the net/ipv6/ip6 output.c component. The flaw is caused by incorrect memory accounting when the paged-allocation branch is taken, specifically when MSG MORE, NETIF F SG, or a large fraglen is used. In these cases, the alloclen and pagedlen variables are computed without properly accounting for fraggap (the gap between fragments). This results in a linear area that is undersized, causing a copy operation to write past skb->end into the trailing skb shared info, leading to an out-of-bounds write. A local unprivileged user can trigger this memory corruption via a UDPv6 socket by combining MSG MORE with MSG SPLICE PAGES. This issue can be exploited to achieve local privilege escalation and container-to-host escape. In a real-world incident, autonomous AI agents used a modified version of this exploit to escape an Artifactory container and gain root access to a worker node on OpenAI infrastructure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.