Look up another CVE · open CVE-2026-53362 in the interactive tracker
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
Published 2026-07-04 (4 months ago) by the Linux kernel CNA. Subsystem net/ipv6. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-53362 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4688-1 · 2026-07-18 · text | 6.1.177-1 | Update the kernel and reboot. DLA-4688-1 shipped the fix on 2026-07-18, in 6.1.177-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6381-1 · 2026-07-05 · text | 6.12.95-1 | Update the kernel and reboot. DSA-6381-1 shipped the fix on 2026-07-05, in 6.12.95-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ipv6/ip6_output.c
- What this is
- NETWORKING [IPv4/IPv6]MAINTAINERS section matched on net/ipv6/ip* · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_IPV6 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_IPV6
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Known to be exploited in the wild
- Added to KEV
- 2026-08-27
- Federal due date
- 2026-08-30
- Ransomware use
- unknown
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Signals
- Published
- 2026-07-04 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.71%, higher than 52.6% of all CVEssource
- CISA KEV
- listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/ipv6
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.0 | 6.1.177 | 14200d435af9 |
| 6.0 | 6.6.144 | 65fb14cbebb0 |
| 6.0 | 6.12.95 | 46f201f8b4c3 |
| 6.0 | 6.18.38 | 6374fb9edf72 |
| 6.0 | 7.1.3 | e9eacf19281e |
| 6.0 | 7.2 | 736b380e28d0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4700-1 | 2026-07-26 | bullseye 6.1.177-1~deb11u1 | tracker |
| DLA-4688-1 | 2026-07-18 | bookworm 6.1.177-1 | tracker |
| DSA-6381-1 | 2026-07-05 | trixie 6.12.95-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is IPv6 transmit skb construction reached by a local process using splice/send operations on an AF_INET6 UDP socket. Received network packets do not enter this path, and a remote peer cannot directly set MSG_SPLICE_PAGES.
- AC:LAttack complexity, low
- No race is required; the attacker controls the UDPv6 socket, MSG_MORE/splice sequence, and send sizes needed to create a nonzero fraggap on the paged allocation path. NETIF_F_SG is common on plausible IPv6 interfaces, so the trigger conditions are not unusually restrictive.
- PR:LPrivileges required, low
- Creating a SOCK_DGRAM IPv6 UDP socket and using splice into it requires only an unprivileged local user. The CAP_NET_RAW check in inet6_create applies to SOCK_RAW, not this UDP datagram path.
- UI:NUser interaction, none
- The attacker directly invokes the local syscalls and socket operations needed to trigger the bug. No victim user action is required.
- S:UScope, unchanged
- The corruption occurs within the kernel networking stack and impacts the same kernel security authority. It is not a VM escape, IOMMU/DMA bypass, or cross-scope boundary violation.
- C:HConfidentiality impact, high
- The bug is an out-of-bounds write into skb_shared_info, which contains fragment metadata and pointers used later by networking code. Such attacker-controlled kernel memory corruption can plausibly be leveraged for information disclosure, so confidentiality is High.
- I:HIntegrity impact, high
- The fraggap bytes come from attacker-controlled skb data and are copied past skb->end into skb_shared_info. This is an out-of-bounds write to kernel metadata and is scored as High integrity impact.
- A:HAvailability impact, high
- Corrupting skb_shared_info can readily crash or panic the kernel during skb handling, checksum, transmit, or cleanup. The vulnerability is therefore a High availability impact.