--- title: "CVE-2026-53362: ipv6: account for fraggap on the paged… | CubePath" description: "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data()…" language: en source: https://cubepath.com/security/cve/CVE-2026-53362 --- # CVE-2026-53362: ipv6: account for fraggap on the paged… | CubePath ## Description In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In \_\_ip6\_append\_data(), when the paged-allocation branch is taken (MSG\_MORE / NETIF\_F\_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb\_shared\_info. An unprivileged user can trigger this via a UDPv6 socket using MSG\_MORE together with MSG\_SPLICE\_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix \_\_ip6\_append\_data()'s handling of MSG\_SPLICE\_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG\_SPLICE\_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG\_SPLICE\_PAGES case, remove the MSG\_SPLICE\_PAGES exception from the negative copy check. Official description from the CVE record, published by Linux. Copyright © 1999-2026 The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CVE license. [View the record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-53362) ## Key data ### CVSS 3.1 High 7.8 Score published by Linux in the CVE record. CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Metric | Value | What it means | | ---------------------- | --------- | ----------------------------------------------------------------------------------------- | | Attack vector | Local | The attacker needs local access to the system, or to trick a user into running something. | | Attack complexity | Low | No special conditions are needed. The attack can be repeated at will. | | Privileges required | Low | A basic user account is needed. | | User interaction | None | No action from any user is needed. | | Scope | Unchanged | The impact stays within the vulnerable component. | | Confidentiality impact | High | Serious or total effect on the secrecy of data. | | Integrity impact | High | Serious or total effect on the trustworthiness of data. | | Availability impact | High | Serious or total effect on availability. | CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and is used by permission. Each CVSS score on this site is shown together with its vector string, as published in the CVE record by the source named next to it. Learn more at [first.org/cvss](https://www.first.org/cvss/) . ### EPSS Exploit Prediction Scoring System by FIRST: an estimate of the probability that exploitation activity will be observed in the next 30 days. Score 0.00709 (0.7% probability) Percentile 53.8% Scores of Nov 10, 2026 Model v2026.06.15 ### CISA Known Exploited Vulnerabilities This CVE is listed in the CISA KEV catalog. Name in the catalog Linux Kernel Unspecified Vulnerability Added to the catalog Aug 27, 2026 Federal due date Aug 30, 2026 ### CISA assessment as of Aug 28, 2026 Stakeholder-Specific Vulnerability Categorization (SSVC) decision points added by CISA. Exploitation Recorded by CISA as active Automatable no Technical impact total ### Weakness (CWE) CWE catalog version 5.0. CWE names: Copyright © 2006-2026, The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CWE license. - [CWE-122](https://cwe.mitre.org/data/definitions/122.html) Heap-based Buffer Overflow ## Affected products Products listed in the CVE record, as the CNA published them. - Linux - affected: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 up to before 14200d435af9a9eeb444f529fc2f689a236b7962 - affected: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 up to before 65fb14cbebb0cd0eff903a22d33537ddc8b95769 - affected: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 up to before 46f201f8b4c39633a1fa3dc12459f506d470993d - affected: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 up to before 6374fb9edf72c67a118a2c214a0dddd04c921e0a - affected: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 up to before e9eacf19281ea2498b36291b56c9606118c2d74e - affected: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 up to before 736b380e28d0480c7bc3e022f1950f31fe53a7c5 - Linux - affected: 6.0 - unaffected: before 6.0 - unaffected: 6.1.177 up to 6.1.\* - unaffected: 6.6.144 up to 6.6.\* - unaffected: 6.12.95 up to 6.12.\* - unaffected: 6.18.38 up to 6.18.\* - unaffected: 7.1.3 up to 7.1.\* - unaffected: 7.2 up to \* ## References Links listed in the CVE record. They lead to other sites, which CubePath does not control. - [git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236…](https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962) - [git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b…](https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769) - [git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d47…](https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d) - [git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c9…](https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a) - [git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c…](https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e) - [git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe5…](https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5) ## Timeline 1. ID reserved Jun 9, 2026 2. Record published Jul 4, 2026 3. Added to CISA KEV Aug 27, 2026 4. Record last updated Oct 15, 2026 ## Look up another CVE ## About CubePath CubePath is a cloud provider with data centers in Europe and the United States. It offers VPS, bare metal servers and DDoS protection. [Cloud VPS](https://cubepath.com/vps) [DDoS protection](https://cubepath.com/ddos-protection) Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 19:07 UTC. [Sources and licenses](https://cubepath.com/security/cve/legal)