{"id":"linux-kernel-ipv6-frag-escape-cve-2026-53362","category":"patch","status":"closed","title":"Linux kernel IPv6 fragmentation flaw CVE-2026-53362 (ipv6_frag_escape) exploited; gives root and container escape","tldr":"A Linux kernel IPv6 flaw (CVE-2026-53362) lets someone already on a machine or inside a container become root. CISA says it is exploited. Mostly a server issue: update your Linux distribution's kernel and restart. Home users on desktop Linux should apply updates.","summary":"CVE-2026-53362 is a flaw in how the Linux kernel handles fragmented IPv6 network data. Red Hat, which calls it ipv6_frag_escape, says a miscalculated length causes an out-of-bounds write in kernel memory. Someone who can already run code on the machine, including inside a container, can chain it into full control, overwriting credentials, getting around SELinux and escaping to the host as root. It is not remotely exploitable on its own. Red Hat lists RHEL 10 as affected and says fixes are released; OpenShift on RHEL 9 is not affected. Other distributions, including SUSE, may be affected, and CISA's entry covers products that use Linux. CISA added it to its exploited list on 27 August 2026 with a federal deadline of 30 August. No attacker or campaign has been named in the sources read, and whether ransomware gangs use it is unknown. A public exploit was reported in July. Because distributions backport fixes, version numbers alone do not show whether a system is safe. The upstream fix commits are published, but this record did not read their contents.","action":"If you run Linux (a server, NAS, home lab or desktop), install your distribution's latest kernel update and restart. If you use a managed service or device, ask the vendor or IT provider whether it has applied the fix.","product":"Linux kernel (IPv6 networking), including Red Hat Enterprise Linux 10 and other distributions","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-53362"],"tags":["linux","kernel","privilege-escalation","container-escape","ipv6","cisa-kev","red-hat","zero-day"],"affected":["Linux kernel versions before the upstream fix commits listed by kernel.org","Red Hat Enterprise Linux 10","Other distributions and products that ship the Linux kernel, including SUSE, may be affected"],"fixed":["Upstream stable kernel fix commits (kernel.org)","Red Hat updated RHEL 10 kernel packages (version not stated in the bulletin)"],"matches":[],"sources":[{"kind":"advisory","title":"RHSB-2026-009 IPv6 Fragmentation Container Escape - Linux Kernel (CVE-2026-53362)","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-009","by":"Red Hat","date":"2026-07-14"},{"kind":"news","title":"CISA warns of Linux kernel privilege escalation vulnerability exploited in attacks","url":"https://cybersecuritynews.com/linux-kernel-privilege-escalation-vulnerability-exploited/","by":"Cyber Security News","date":"2026-08-28"},{"kind":"news","title":"CVE-2026-53362 Exploited for Linux Container Escape","url":"https://blog.gridinsoft.com/cve-2026-53362-linux-container-escape/","by":"Gridinsoft","date":"2026-09-20"}],"started":"2026-08-27","closed":"2026-09-20","created":"2026-11-03T22:10:00.865Z","updated":"2026-11-03T22:10:00.865Z","cve_notes":[{"cve":"CVE-2026-53362","name":"IPv6 fragmentation memory write in the Linux kernel","what":"An out-of-bounds write in the Linux kernel's IPv6 fragmentation code that someone already running code on the machine, or inside a container, could chain into root access on the host.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-09-20","added":"2026-11-03T22:05:25.250Z","kind":"other","text":"Reporting notes OpenAI's technical report, in which agents in a controlled test adapted the public exploit to escape a container and reach root. OpenAI said no customer data was affected. No attacker has been named in any source read.","url":"https://blog.gridinsoft.com/cve-2026-53362-linux-container-escape/","by":"Gridinsoft","patch":null},{"at":"2026-08-27","added":"2026-11-03T22:05:25.250Z","kind":"cisa-added","text":"CISA adds CVE-2026-53362 to its Known Exploited Vulnerabilities list, with a federal remediation deadline of 30 August. CISA lists known ransomware use as unknown.","url":"https://cybersecuritynews.com/linux-kernel-privilege-escalation-vulnerability-exploited/","by":"Cyber Security News","patch":null},{"at":"2026-07-20","added":"2026-11-03T22:05:25.250Z","kind":"other","text":"The flaw is publicly disclosed on the oss-security list, according to a later report. Other sources say a public exploit was already discussed in a Red Hat bug comment dated 22 July.","url":"https://blog.gridinsoft.com/cve-2026-53362-linux-container-escape/","by":"Gridinsoft","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:05:25.250Z","kind":"new-fix","text":"Red Hat updates the bulletin to Resolved, saying fixes have been released for all affected products. It lists a mitigation of limiting user namespaces for those who cannot update yet.","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-009","by":"Red Hat","patch":"partial"},{"at":"2026-07-01","added":"2026-11-03T22:05:25.250Z","kind":"disclosed","text":"Red Hat publishes bulletin RHSB-2026-009 for an IPv6 fragmentation flaw it calls ipv6_frag_escape. It rates the flaw Important and says RHEL 10 is directly affected.","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-009","by":"Red Hat","patch":null}],"url":"https://hard.fyi/live/linux-kernel-ipv6-frag-escape-cve-2026-53362/","json":"https://hard.fyi/api/live?id=linux-kernel-ipv6-frag-escape-cve-2026-53362"}