What is the CVSS score of CVE-2026-53362?

CVE-2026-53362 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-53362?

Yes, a public proof-of-concept exploit is available for CVE-2026-53362. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-53362?

Within 24 hours, identify all production Linux systems and obtain vendor security advisories (Red Hat, Ubuntu, Debian, SUSE, etc.) to determine which kernel versions are affected by CVE-2026-53362. Within 7 days, apply vendor-released patches from your Linux distribution and validate the patch in non-production environments to ensure compatibility with running services. Within 30 days, complete rollout of patched kernels across all production systems, verify updated kernel versions are running via system audits, and confirm systems have been rebooted to load the patched kernels into memory.

Linux Kernel CVE-2026-53362

EUVD-2026-41669 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-04 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-3x6f-vm7x-cgm7

Buffer Overflow Linux Heap Overflow

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain local unprivileged account
Delivery

Open UDPv6 socket
Exploit

Send MSG_MORE then MSG_SPLICE_PAGES with crafted sizing
Execution

Force non-zero fraggap on second skb
Persist

Overflow past skb->end into skb_shared_info
Impact

Groom heap for privilege escalation or crash

Vulnerability Assessment

Weakness	CWE CWE-122 ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a local unprivileged account able to open a UDPv6 socket (PR:L, AV:L). The attacker must send data using MSG_MORE combined with MSG_SPLICE_PAGES so that the paged-allocation branch of __ip6_append_data() is taken (triggered by MSG_MORE, NETIF_F_SG, or a large fraglen) and so that a subsequent, non-first skb is built with a non-zero fraggap carried over from the previous skb - that fraggap being non-zero is the exact condition that produces the undersized linear area and the out-of-bounds write. A key limiting factor: the corruption is only reachable on kernels that also contain commit ce650a166335 ('udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES'); before that change the negative copy value was rejected with -EINVAL, so kernels with the introducing commit 773ba4fe9104 but without ce650a166335 return an error instead of corrupting memory. Exploitation is confined to the local host - no remote or network-adjacent access is possible.
Impact	The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) accurately reflects a local, low-complexity, low-privilege memory-corruption bug - no authentication beyond an ordinary local account and no user interaction. Corroborating signals are mixed: EPSS is very low (0.18%, 7th percentile), the CVE is not on CISA KEV, and no public exploit is identified, so this is not evidence of active or imminent widespread exploitation. However, the low EPSS should not be read as low technical severity: a controllable heap overflow into skb_shared_info is a well-known primitive for kernel privilege escalation, and the trigger requires only an unprivileged UDPv6 socket, which raises real risk on multi-tenant or untrusted-local-user systems. The provided tag 'Information Disclosure' understates the impact - the described behavior is an out-of-bounds write (memory corruption), not merely a read, and the CVSS I:H/A:H reflect that. No SSVC decision data is provided in the input, so automatability and technical-impact framework values could not be cross-referenced.
Exploit ScenarioDerived	A local unprivileged user (for example a low-privileged account or a process inside a container that shares the host kernel) opens a UDPv6 socket and issues a carefully sized send using MSG_MORE followed by MSG_SPLICE_PAGES so that a second skb is built with a non-zero fraggap, causing the copy to overflow past skb->end into the adjacent skb_shared_info. By grooming the kernel heap the attacker aims to corrupt adjacent objects to escalate privileges or crash the system. No public proof-of-concept is identified at time of analysis, and the local, low-complexity vector (AV:L/AC:L) means no network position is required.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 18, 2026

Heap out-of-bounds write in the Linux kernel's IPv6 stack (__ip6_append_data) lets a local unprivileged user corrupt kernel memory by sending data through a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. On the paged-allocation path the linear skb area is undersized by 'fraggap' bytes while pagedlen is overstated by the same amount, so the copy writes past skb->end into the trailing skb_shared_info. No public exploit is identified at time of analysis and EPSS is low (0.18%, 7th percentile), but the flaw is locally triggerable without special privileges and the vendor has released fixes.

RemediationAI

Vendor-released patch: update to Linux 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, or mainline 7.2-rc1 (or your distribution's kernel that backports the fixing commits listed on git.kernel.org, such as https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5). Apply the kernel update and reboot; live-patching may not cover this networking change, so schedule a maintenance reboot. Where immediate patching is not possible, reduce exposure by limiting who can run untrusted local code, since exploitation needs only an unprivileged local account; on systems that do not require it you can constrain IPv6 UDP usage, but note MSG_SPLICE_PAGES/MSG_MORE cannot be selectively disabled per-socket by administrators, so realistic compensating controls are restricting local shell/container access and enabling kernel hardening (e.g. slab hardening, CONFIG_SLAB_FREELIST_HARDENED) to raise the difficulty of turning the overflow into code execution. Track vendor advisories via the oss-security threads (https://seclists.org/oss-sec/2026/q3/132, https://seclists.org/oss-sec/2026/q3/141).

Affected VersionsENISA

Linux patch: 6.1.177

Linux 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 <736b380e28d0480c7bc3e022f1950f31fe53a7c5

Linux 6.0

Linux patch: 6.6.144

Linux 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 <14200d435af9a9eeb444f529fc2f689a236b7962

Linux 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 <6374fb9edf72c67a118a2c214a0dddd04c921e0a

Linux 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 <65fb14cbebb0cd0eff903a22d33537ddc8b95769

Linux 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 <46f201f8b4c39633a1fa3dc12459f506d470993d

Linux patch: 6.12.95

Linux patch: 6.18.38

Linux patch: 7.2-rc1

Linux 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 <e9eacf19281ea2498b36291b56c9606118c2d74e

Linux patch: 7.1.3

Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The bug lives in net/ipv6/ip6_output.c __ip6_append_data(), the routine that assembles outbound IPv6 datagrams into socket buffers (skbs), including fragmented and scatter-gather (NETIF_F_SG) sends. When continuing a multi-skb send, leftover 'fraggap' bytes from the previous skb are carried into the new skb's linear area just past the fragment headers. In the paged branch (taken for MSG_MORE / SG / large fraglen), alloclen was computed as fragheaderlen + transhdrlen and pagedlen as datalen - transhdrlen, but datalen already includes fraggap; since transhdrlen is zero on non-first skbs, the linear allocation is short by fraggap bytes. The root-cause class is a classic out-of-bounds write (CWE-787) driven by an integer/length-accounting error; the CVE reports CWE as N/A. The defect was introduced by commit 773ba4fe9104 ('ipv6: avoid partial copy for zc') and became actually triggerable after commit ce650a166335 ('udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES'), which stopped rejecting the previously-negative copy value with -EINVAL. The fix brings the paged branch in line with the non-paged branch by adding fraggap to alloclen and subtracting it from pagedlen.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local unprivileged account and a plain UDPv6 socket suffice (AV:L/AC:L/PR:L/UI:N); the heap out-of-bounds write yields high confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Red Hat 7.8 HIGH

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Aug 27, 2026 - 17:32 CISA

CVSS changed

Jul 18, 2026 - 08:22 NVD

7.8 (HIGH)

Patch available

Jul 04, 2026 - 13:01 EUVD

CVE Published

Jul 04, 2026 - 12:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 04, 2026 - 12:17 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: account for fraggap on the paged allocation path

In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as

alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;

datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info.

An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES.

The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable.

The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen.

After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

Executive ViewAI

Why It Matters

A heap out-of-bounds write vulnerability in the Linux kernel's IPv6 stack (CVE-2026-53362, CVSS 7.8) allows local users to corrupt kernel memory. No public exploit identified at time of analysis, but the vulnerability poses HIGH risk for local privilege escalation and system compromise on affected systems. Organizations must prioritize patching production Linux systems where vendors have released fixes.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

Threat Score

4.6/10

Composite threat intelligence

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Ubiquitous

Linux kernel IPv6 stack runs on a huge fraction of production systems

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

CISA KEV

EPSS MSRC Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 0.2%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Active

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

109

Low Medium High Critical

KEV: +50

EPSS: 0

CVSS: +39

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Same weakness CWE-122 – Heap-based Buffer Overflow

View all

CVE-2023-4911 HIGH POC

7.8

CVE-2023-27997 CRITICAL

9.8

CVE-2026-94127 CRITICAL POC

9.3

CVE-2025-25249 CRITICAL POC

9.8

CVE-2026-85880 HIGH POC

7.8

CVE-2025-24985 HIGH POC

7.8

CVE-2025-21418 HIGH

7.8

CVE-2023-23376 HIGH

7.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155	Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152	Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure	Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE	Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

SUSE Liberty Linux 10	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Live Patching 15 SP6	Fixed
SUSE Linux Enterprise Live Patching 15 SP7	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7	Fixed
SUSE Linux Enterprise Module for Legacy 15 SP7	Fixed
SUSE Linux Enterprise Module for Public Cloud 15 SP7	Fixed
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7	Fixed
SUSE Linux Micro 6.0	Fixed
SUSE Linux Micro 6.1	Fixed
SUSE Linux Micro 6.2	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Live Patching 15 SP7	Affected
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Affected
SUSE Linux Micro Extras 6.2	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected
SUSE Linux Enterprise High Availability Extension 16.1	Affected
SUSE Linux Enterprise High Availability Extension 16.1	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected