Skip to main content

Linux Kernel CVE-2026-53366

| EUVDEUVD-2026-44868 HIGH
2026-07-16 Linux GHSA-r67c-r6r6-mj6m
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.8 MEDIUM

Local low-priv socket access (AV:L/PR:L); trigger needs the paged path with a non-zero fraggap so AC:H; primary impact is kernel memory disclosure (C:H) with limited corruption/crash potential (I:L/A:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
8.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 18, 2026 - 08:30 vuln.today
CVSS changed
Jul 18, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jul 16, 2026 - 07:02 EUVD
CVE Published
Jul 16, 2026 - 05:13 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 16, 2026 - 05:13 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv4: account for fraggap on the paged allocation path

In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as

alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;

datalen already includes fraggap, but the fraggap bytes carried over from the previous skb are copied into the new skb's linear area at offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount.

The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen.

After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic.

AnalysisAI

Information disclosure and memory-safety defect in the Linux kernel's IPv4 output path (__ip_append_data) affects kernels from 6.0 up to the fixed 6.6.144, 6.12.95, 6.18.38 and 7.1.3 releases, where the paged-allocation branch under-sizes the new skb's linear area by the fraggap byte count while overstating pagedlen. A local user driving corked/fragmented socket writes can trigger the miscalculation, potentially leaking adjacent kernel memory (vendor tags classify it as Information Disclosure) or causing corruption. There is no public exploit identified at time of analysis, EPSS is low at 0.19% (9th percentile), and it is not listed in CISA KEV.

Technical ContextAI

The flaw lives in net/ipv4/ip_output.c in __ip_append_data(), the core routine that assembles outbound IPv4 datagrams from socket data, honoring cork/MSG_MORE batching and IP fragmentation. When a fragment gap (fraggap) - trailing bytes carried over from the previous skb to satisfy alignment/checksum boundaries - must be copied forward, the non-paged branch correctly sizes the buffer to fraglen (which already includes fraggap via datalen). The paged branch instead set alloclen = fragheaderlen + transhdrlen and pagedlen = datalen - transhdrlen, ignoring that datalen already includes fraggap; skb_copy_and_csum_bits() then copies the fraggap bytes into a linear area that is fraggap bytes too small, while pagedlen is overstated by the same amount. This is a length/allocation accounting error (CWE class ~ CWE-131 Incorrect Calculation of Buffer Size / CWE-682 Incorrect Calculation) rather than a classic parsing bug. The affected CPE is the generic cpe:2.3:a:linux:linux; the regression was introduced by commit 8eb77cc73977 and fixed by the series ending at ce494707a9c0 / a9c24eda24bd and stable backports.

RemediationAI

Upgrade to a fixed kernel: Vendor-released patch: 6.6.144, 6.12.95, 6.18.38, 7.1.3, or mainline 7.2-rc1, whichever matches your branch, sourced from the kernel.org stable tree (commits referenced at https://git.kernel.org/stable/c/ce494707a9c07f27c219ca67f3e138061f53d9b3 and the sibling backport commits). For distribution kernels, apply your vendor's update that incorporates these commits rather than building from a raw commit. No practical userspace configuration workaround exists because the defect is in the core IPv4 transmit path exercised by ordinary socket writes; there is no single feature toggle to disable it. As an interim compensating control on multi-tenant hosts, limit untrusted local users' ability to run custom networking code (e.g., restrict CAP_NET_RAW and unprivileged network namespaces via sysctl user.max_net_namespaces=0 and disable unprivileged userns where feasible), accepting that this reduces container functionality and does not fully eliminate the standard socket path that triggers the bug.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

Share

CVE-2026-53366 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy