A buffer overflow vulnerability in the Linux kernel's IPv6 stack is already being actively exploited for cyberattacks. It lets unprivileged users corrupt memory and execute their own code via UDPv6 sockets. Patches are available for several kernel versions, and you should apply them promptly.
Incorrect buffer size during packet fragmentation
The vulnerability, CVE-2026-53362, carries a CVSS score of 7.8. The cause is a faulty memory calculation in the function __ip6_append_data(), the internal kernel function that builds IPv6 packets. It lets unprivileged users trigger a buffer overflow via UDPv6 sockets using the MSG_MORE and MSG_SPLICE_PAGES flags. When the function uses the paged allocation branch, the variables alloclen (allocated memory) and pagedlen (page data length) get calculated incorrectly.
Normally, these sizes account for the fragment gap, meaning bytes left over from the previous fragment that get copied into the next one. The faulty implementation forgets to do this, which makes the linear memory region of the new packet undersized by so-called fraggap bytes, while pagedlen gets overestimated by the same amount. When the system tries to copy data, it writes past the buffer boundary into the skb_shared_info area. Depending on the kernel version and configuration, this can lead to a denial of service or, under certain conditions, code execution.
Affected versions and available patches
The bug was introduced by commit 773ba4fe9104 and made worse by commit ce650a166335. Patches are available for kernel 6.0 and later, kernel 6.1 (patch 6.1.177), kernel 6.6 (patch 6.6.144), kernel 6.12 (patch 6.12.95), kernel 6.18 (patch 6.18.38), kernel 7.1 (patch 7.1.3), and kernel 7.2. Several Linux distributors, including Red Hat, SUSE, and openSUSE, have already released security updates.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 27, 2026, meaning it's considered actively exploited. If you run or administer Linux systems, you should check your kernel versions immediately and apply the available security updates.