A Local IPv6 Packet Became a Route From an Unprivileged Container to the Linux Host.
CISA says attackers are exploiting a Linux kernel memory-corruption flaw that can turn local access into root. A public exploit also demonstrates how the bug can become a container-to-host escape when unprivileged user namespaces provide the network capabilities it needs.
The vulnerability, CVE-2026-53362, was added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue on 27 August 2026. Federal civilian agencies have until 30 August to apply vendor fixes or remove affected systems from service.
CISA has not identified the attackers, affected organisations or post-exploitation activity. Ransomware use is listed as unknown. The confirmed fact is active exploitation of the vulnerability, not a specific campaign or a claim that every Linux host is remotely exploitable.
This is a local flaw in the IPv6 transmit path
CVE-2026-53362 sits in the Linux kernel’s IPv6 packet-building code. Under a particular combination of UDPv6, MSG_MORE and MSG_SPLICE_PAGES, the kernel miscalculates the memory needed when packet data crosses a fragment boundary.
The copied fragment gap can extend past the allocated packet buffer and into the adjacent skb_shared_info structure. Researchers described a controlled out-of-bounds write that can be developed into local privilege escalation. An ordinary user who can reach the required kernel path may be able to execute code with root privileges.
The network terminology can be misleading. This is not a conventional remote attack in which an unauthenticated Internet host sends one malicious IPv6 packet to a server. The attacker needs local code execution or an equivalent foothold that can create the required socket operations.
Why containers change the impact
The public ipv6_frag_escape exploit shows a more operationally significant path. It uses an unprivileged user namespace to obtain the network capabilities needed to craft the malicious packet sequence from inside a container. In a vulnerable configuration, the kernel bug can provide a route from that container to the host.
That does not make every container deployment vulnerable. The exploit depends on the affected kernel code, IPv6 support and the availability of the namespace and capability path. Hardened runtimes, restricted user namespaces and patched distribution kernels can break the chain.
It does, however, challenge a common risk assumption. A workload may be considered low impact because it runs as an unprivileged container user, yet the kernel remains the shared security boundary. Once attackers have a reliable kernel memory primitive, the permissions inside the container are no longer the final limit.
A related IPv4 flaw has the same root cause
The oss-security disclosure also documents CVE-2026-53366, an IPv4 variant arising from the same fragment-boundary accounting problem. CISA’s 27 August KEV addition names CVE-2026-53362, not the IPv4 identifier. Teams should keep the two exploitation states separate while still checking their distribution’s complete kernel advisory.
Use distribution fixes, not an upstream version guess
The vulnerable code was introduced in upstream Linux 6.1 development and corrected by a set of stable-branch commits, including the main fix merged for Linux 7.2-rc1. Enterprise distributions routinely backport security corrections without adopting the upstream release number, so a simple uname -r comparison is not enough.
Red Hat published a dedicated important-severity security bulletin for the IPv6 fragmentation container escape. SUSE rates the issue important, lists it as resolved overall and has released updates for numerous supported kernel packages. Administrators should use the advisory and package status for the exact distribution, product and kernel flavour in production.
What defenders should do now
- Inventory the running kernel, not only the installed package. Hosts need to boot into the fixed kernel before remediation is complete.
- Check every kernel stream. Cloud, real-time, hardware-enablement, FIPS and appliance kernels may have different package names and patch status.
- Prioritise multi-tenant and container hosts. Systems running untrusted workloads, developer sandboxes, build jobs and customer containers have the clearest route from an initial foothold to host compromise.
- Review user-namespace policy. If unprivileged user namespaces are not operationally required, disabling them can interrupt the public exploit path. Test first because rootless containers and desktop sandboxing may depend on the feature.
- Consider IPv6 exposure carefully. Disabling IPv6 can be a temporary mitigation where the protocol is genuinely unused, but an unplanned shutdown can break name resolution, service discovery and management paths.
- Hunt beyond the container. Investigate unexpected privilege changes, namespace creation, kernel faults, suspicious processes on the host and unusual activity immediately after container execution.
The Fedora CoreOS tracker notes two temporary controls: disabling IPv6 at boot where appropriate, or setting user.max_user_namespaces=0. Both have operational consequences. They should be treated as risk-reduction measures while fixed kernels are deployed, not as permanent substitutes for patching.
The defensive lesson
This vulnerability begins with a low-privileged local user and a narrow packet-construction condition. Its significance comes from what that primitive can cross: the boundary between an unprivileged workload and the shared host kernel.
With a public exploit available and CISA now confirming active exploitation, defenders should not let the word local push the issue into a routine patch cycle. On exposed workload platforms, local access is often the starting point supplied by a compromised application, container or developer account. The kernel flaw is what turns that foothold into control of the host.
Sources and further reading
- CISA Known Exploited Vulnerabilities Catalog, catalogue update released 27 August 2026 at 17:00 UTC
- NVD entry for CVE-2026-53362, published 4 July 2026
- oss-security technical disclosure for CVE-2026-53362 and CVE-2026-53366, posted 20 July 2026 at 16:39 UTC
- Public ipv6_frag_escape exploit repository
- Fedora CoreOS tracker: IPV6_FRAG_ESCAPE
- Red Hat Security Bulletin RHSB-2026-009
- SUSE CVE-2026-53362 package status and advisories
