Heap buffer overflow in Linux kernel IPv6 UDP stack (CVE-2026-53362)

CVE-2026-53362 is a Linux kernel heap buffer overflow in `__ip6_append_data()` caused by incorrect accounting of `fraggap` bytes on the paged allocation path, resulting in writes past `skb->end` into the trailing `skb_shared_info`. An unprivileged user can trigger memory corruption via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES, and the vulnerability has been exploited in the wild to achieve root privilege escalation. Affected versions: - 6.12.90+deb13.1-amd64 We recommend updating to: 6.12.95. CVSS 7.8 · our assessment: this_week Vendor advisory: https://seclists.org/oss-sec/2026/q3/132 Details: https://vuln.today/cve/CVE-2026-53362