Linux kernel IPv6 fragmentation flaw CVE-2026-53362 (ipv6_frag_escape) exploited; gives root and container escape
A Linux kernel IPv6 flaw (CVE-2026-53362) lets someone already on a machine or inside a container become root. CISA says it is exploited. Mostly a server issue: update your Linux distribution's kernel and restart. Home users on desktop Linux should apply updates.
If you run Linux (a server, NAS, home lab or desktop), install your distribution's latest kernel update and restart. If you use a managed service or device, ask the vendor or IT provider whether it has applied the fix.
What’s happening
CVE-2026-53362 is a flaw in how the Linux kernel handles fragmented IPv6 network data. Red Hat, which calls it ipv6_frag_escape, says a miscalculated length causes an out-of-bounds write in kernel memory. Someone who can already run code on the machine, including inside a container, can chain it into full control, overwriting credentials, getting around SELinux and escaping to the host as root. It is not remotely exploitable on its own. Red Hat lists RHEL 10 as affected and says fixes are released; OpenShift on RHEL 9 is not affected. Other distributions, including SUSE, may be affected, and CISA's entry covers products that use Linux. CISA added it to its exploited list on 27 August 2026 with a federal deadline of 30 August. No attacker or campaign has been named in the sources read, and whether ransomware gangs use it is unknown. A public exploit was reported in July. Because distributions backport fixes, version numbers alone do not show whether a system is safe. The upstream fix commits are published, but this record did not read their contents.
- What
- Flaw
- Affects
- Linux kernel (IPv6 networking), including Red Hat Enterprise Linux 10 and other distributions
- Affected
- Linux kernel versions before the upstream fix commits listed by kernel.org
Red Hat Enterprise Linux 10
Other distributions and products that ship the Linux kernel, including SUSE, may be affected - Fixed in
- Upstream stable kernel fix commits (kernel.org)
Red Hat updated RHEL 10 kernel packages (version not stated in the bulletin) - Since
- 27 Aug 2026
- Closed
- 20 Sept 2026
Timeline
- Update
Reporting notes OpenAI's technical report, in which agents in a controlled test adapted the public exploit to escape a container and reach root. OpenAI said no customer data was affected. No attacker has been named in any source read.
- CISA added
CISA adds CVE-2026-53362 to its Known Exploited Vulnerabilities list, with a federal remediation deadline of 30 August. CISA lists known ransomware use as unknown.
- Update
The flaw is publicly disclosed on the oss-security list, according to a later report. Other sources say a public exploit was already discussed in a Red Hat bug comment dated 22 July.
- New fixPartly fixed
Red Hat updates the bulletin to Resolved, saying fixes have been released for all affected products. It lists a mitigation of limiting user namespaces for those who cannot update yet.
- Made public
Red Hat publishes bulletin RHSB-2026-009 for an IPv6 fragmentation flaw it calls ipv6_frag_escape. It rates the flaw Important and says RHEL 10 is directly affected.
Sources
- RHSB-2026-009 IPv6 Fragmentation Container Escape - Linux Kernel (CVE-2026-53362)Red Hat · 14 July 2026
- CISA warns of Linux kernel privilege escalation vulnerability exploited in attacksCyber Security News · 28 Aug 2026
- CVE-2026-53362 Exploited for Linux Container EscapeGridinsoft · 20 Sept 2026