Linux kernel bug lets local users become root

Published August 27, 2026 CVE-2026-53362

A bug in the Linux kernel's networking code lets a regular logged-in user become root, the most powerful account on the machine. Public exploit code already exists, so systems that have not installed the fix are an easy target.

Severity
HighCVSS 3.1 · 7.8
Fix
Fixed in 6.1.177, 6.6.144, 6.12.95 +3Fix recorded on Sep 2, 2026
Affected versions
6.1.* before 6.1.177; 6.6.* before 6.6.144; 6.12.* before 6.12.95+2 more
Exploit likelihood
0.51% in 30 daysEPSS, higher than 42% of known flaws
Affects
Linux
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 27, 2026
Federal fix deadline
Aug 30, 2026

How it works

  • A logged-in user opens a network connection using IPv6 and a feature that builds a message in pieces, then adds a page-based data chunk partway through.
  • The kernel miscounts a few leftover bytes and writes about 15 bytes past the end of its own buffer into memory it does not own.

What to do

Check your running kernel version with uname -r and compare it against your Linux distribution's kernel advisory to see if you are on a build older than the fixed one for your branch (6.1.177, 6.6.144, 6.12.95, 6.18.38, or 7.1.3).

Install your distribution's latest kernel update, which includes the fix for this exact accounting error, then reboot or use live kernel patching if your system supports it. If you cannot patch immediately, limit which local accounts and containers can run untrusted code.

Technical details

A user with only a normal account already runs code on a Linux server or container. They open a UDP connection over IPv6, build a message in pieces, and slip in a page-based data chunk partway through. The kernel miscounts the leftover bytes and writes about 15 bytes past its buffer into neighboring kernel memory. The researcher who found the bug showed that small overwrite can be stretched into full read and write access to the machine's memory, ending with a rewritten kernel setting that runs a helper program as root.

The bug sits in ip6_append_data in the kernel's IPv6 UDP send path. When a socket cork spans a fragment boundary and MSG_SPLICE_PAGES is used, the kernel undercounts a small carried-over byte range called the fraggap, sizing the linear buffer too small while overstating the paged length. The resulting copy writes past skb-end into the adjacent skb_shared_info structure, an out-of-bounds write of roughly 15 bytes.

The flawed accounting was introduced in commit 773ba4fe9104 and became triggerable once commit ce650a166335 allowed MSG_SPLICE_PAGES to proceed in this case. IPv6 support must be enabled for the path to be reachable.

Severity breakdown

  • Attack vector Local Needs local access to the machine
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source