A flaw in the Linux kernel's IPv6 fragment handling, resolved upstream in the patch that accounts for fraggap on the paged allocation path in __ip6_append_data(). NVD scores it 7.8 (High, CVSS 3.1).
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-53362 |
| CVSS | 7.8 (High, CVSS 3.1) |
| Vendor / product | Linux kernel / Linux kernel — IPv6 fragment handling |
| Reported | 2026-08-27 |
When the paged-allocation branch is taken (MSG_MORE, scatter-gather networking, a large fragment length), alloclen and pagedlen are computed in a way that ignores that datalen already includes the fragment gap, so the accounting and the actual allocation diverge. CISA added it to the KEV Catalog on 27 August 2026 on evidence of active exploitation. Kernel flaws of this class are the quiet part of a KEV batch: they are patched through a full kernel update rather than a vendor advisory, so the exposure check is distribution-level — confirm the running kernel carries the fix on every internet-facing host, not just the ones with a formal patch cycle.