CVE-2026-53362 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2026-07-04

Added to CISA KEV: 2026-08-27 54 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This vulnerability is in CISA KEV with confirmed active exploitation. Review container/host logs for signs of escape (unexpected root processes, SELinux denials, anomalous namespace usage), verify host integrity, and hunt for post-exploitation persistence.
Immediately patch to fixed kernel releases: 6.1.177+, 6.6.144+, 6.12.95+, 6.18.38+, 7.1.3+, or 7.2+ per your distribution's security tracker (Red Hat RHSB-2026-009, Debian, Ubuntu).
Mitigation if patching is delayed: disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) to remove the primary in-the-wild exploitation vector for container escape.
Harden container runtimes (drop CAP_NET_RAW where possible, enforce seccomp profiles restricting sendmsg/splice flags, use gVisor/Kata for stronger isolation).
Patch Priority: URGENT — KEV-listed, active container-escape exploitation, total system compromise on success.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-53362, also known as "ipv6_frag_escape," is an out-of-bounds write vulnerability residing in the IPv6 networking subsystem of the Linux kernel ^[1]^[6]. It stems from an incorrect parameter length calculation during the handling of fragmented IPv6 packets on the paged allocation path ^[4]^[7]. This vulnerability is critical because it allows an attacker with limited access to escape from a container environment to the host system and escalate privileges to root ^[1].

Exploitation

Active Exploitation: Reports indicate that this vulnerability is being actively exploited in real-world cyberattacks ^[5].
Availability: Public exploit code exists and has been observed in use ^[2].
Prerequisites:

* Requires local access or access within a containerized environment ^[1]. * Exploitation typically utilizes unprivileged user namespaces to obtain the necessary network capabilities to craft malicious IPv6 packets ^[2]. * No user interaction is required for a successful attack once the adversary has the required level of access.

Affected Products & Patches

Affected Versions: The vulnerability affects various versions of the Linux kernel; users should consult their specific distribution's security trackers (e.g., Debian, Ubuntu, Red Hat) for the precise list of affected kernels ^[3]^[8].
Resolution: The vulnerability has been resolved in upstream Linux kernel releases ^[4].
Mitigation: Organizations should apply the latest kernel security updates provided by their Linux distribution vendor immediately. If patching is not immediately feasible, disabling unprivileged user namespaces may mitigate the exploit vector in certain environments.

Impact

Capabilities: Successful exploitation grants an attacker full system administrator (root) access on the host machine ^[1].
Escalation: It enables a "container escape," allowing a compromised container to break out of its isolation boundaries and compromise the underlying host OS, effectively bypassing security mechanisms such as SELinux ^[1].
Business Risk: For internet-facing deployments relying on containerized infrastructure (e.g., Kubernetes, Docker), this represents a severe risk of total system compromise, data theft, and persistence establishment if a single container is breached.

Sources

RHSB-2026-009 IPv6 Fragmentation Container Escape - Linux Kernel (CVE ...
This issue, also referred to as ipv6_frag_escape, has been assigned CVE-2026-53362. A user with local access inside a container could escape to the host, bypassing SELinux enforcement, and gain system administrator (root) access.
CVE-2026-53362: IPV6_FRAG_ESCAPE vulnerability #2177
The public exploit relies on an unprivileged user namespace to obtain the network capabilities it needs to craft the malicious IPv6 packets ...
CVE-2026-53362 - Security Bug Tracker - Debian
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path. An unprivileged user can trigger ... Vulnerable and fixed packages The table below lists information on source packages.
Linux vulnerability CVE-2026-53362 is being exploited in ...
a vulnerability being exploited in cyberattacks. Linux vulnerability CVE-2026-53362 is being exploited in real attacks. A place to discuss bug ...
CVE-2026-53362 Detail - NVD
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path. An unprivileged ... Quick Info CVE Dictionary Entry: CVE-2026-53362 NVD Published Date: Jul 04, 2026 NVD Last Modified: Aug 28, 2026 Source: kernel.org…

🟢 CVE-2026-53362