VulnSocial

CVE-2026-53366General(linux / linux_kernel)

HIGHCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

  • Patch linux linux_kernel systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap, but the fraggap bytes carried over from the previous skb are copied into the new skb's linear area at offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic.

linux CVEsBack to dashboard
7.5/ 10 priority

Sources & remediation

Patch / fix
Other references

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • linux_kernel

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 9 mentions across 6 observed days

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 6 signals
  • General: 2 classified signals
  • Peaked 5d ago at 3 mentions (2026-07-16); latest day: 1
  • 9 total mentions across 6 days

Affected systems

Vendors
linux
Products
linux_kernel

Deep dive

Activity timeline9 mentions / 6d
01223Mentions · 2026-07-16: 3Mentions · 2026-07-18: 1Mentions · 2026-07-20: 1Mentions · 2026-07-22: 2Mentions · 2026-07-26: 1Mentions · 2026-08-01: 1PoC Mentioned / Linked · 2026-07-20: 1PoC Mentioned / Linked · 2026-08-01: 1Exploit Tool / Code · 2026-07-20: 1Active Exploitation · 2026-07-16: 1Patch / Workaround · 2026-07-18: 1Patch / Workaround · 2026-07-26: 1Technical Details · 2026-07-16: 1Technical Details · 2026-07-18: 1Technical Details · 2026-07-20: 1Technical Details · 2026-07-22: 1Technical Details · 2026-07-26: 1Technical Details · 2026-08-01: 107-1607-1807-2007-2207-2608-01
Signal classification5 categories
General
222.2%
Patch
222.2%
PoC
222.2%
Disclosure
222.2%
Active Exploitation
111.1%
Referenced assets8 URLs
Classification over time
DateTotalLabels
2026-07-163
Active Exploitation1General2
2026-07-181
Patch1
2026-07-201
PoC1
2026-07-222
Disclosure2
2026-07-261
Patch1
2026-08-011
PoC1
Full discourse9 posts
  • qwerty@_qwerty_po
    PoC

    Introducing the Frag Gap (CVE-2026-53362/CVE-2026-53366)! A bug in ipv4/ipv6 that I found together with @physicube, and it (used to) let you freely get root. This could affect Android too, but we don't have a device so... Full details are written up in both EN and KO at https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/ If you're curious about the code, just checking out https://github.com/qwerty-po/security-research/tree/cve-2026-53362/pocs/linux/kernelctf/CVE-2026-53362_lts is enough. We've got a few more fun bugs, and we'll post them as we find the time. This is just the Hitchhiker's Guide to the Linux Kernel. Don't Kernel Panic!

    Post summary

    Researchers disclosed a privilege‑escalation bug (CVE‑2026‑53362/53366), shared blog details, and provided a GitHub repository containing a PoC exploit script.

    11129562532033.4K
    1.7K followersView on X
  • Open Source Security mailing list@oss_security
    Disclosure

    CVE-2026-53362,CVE-2026-53366: Linux kernel: OOB write in UDP MSG_SPLICE_PAGES fragment-boundary handling https://www.openwall.com/lists/oss-security/2026/07/20/2 LPE. The IPv6 variant needs CONFIG_IPV6=y. IPv4 needs USERNS. Affected from v6.1.

    Post summary

    The message announces the discovery of two Linux kernel CVEs (CVE-2026-53362 and CVE-2026-53366) involving an out‑of‑bounds write in UDP MSG_SPLICE_PAGES that can lead to local privilege escalation, with details on affected subsystems and kernel versions.

    11040753
    4.7K followersView on X
  • Kazuki Omo@omokazuki
    Disclosure

    Linux Kernelの脆弱性(IPV6_FRAG_ESCAPE: CVE-2026-53362, CVE-2026-53366) #security #vulnerability #セキュリティ #脆弱性 #linux #kernel #ipv6 #selinux https://security.sios.jp/vulnerability/kernel-security-vulnerability-20260723/

    Post summary

    The text announces new Linux Kernel vulnerabilities (CVE-2026‑53362 and CVE-2026‑53366) related to IPv6 frag escape, with details presumably provided in the linked article.

    00010195
    370 followersView on X
  • Open Source Security mailing list@oss_security
    PoC

    "CVE-2026-53362,CVE-2026-53366: Linux kernel: OOB write in UDP MSG_SPLICE_PAGES fragment-boundary handling" exploits and detailed blog post https://www.openwall.com/lists/oss-security/2026/07/22/15

    Post summary

    The text announces that proof‑of‑concept exploits for CVE‑2026‑53362 and CVE‑2026‑53366 have been published in a detailed blog post.

    00000179
    4.7K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-53366 — Linux kernel IPv4 vulnerability (CVSS 7.8). Memory allocation flaw in __ip_append_data() could lead to system compromise. Patch immediately. #CVE #PatchNow #ThreatIntel https://t.co/lbGx7HKl5i

    Post summary

    The tweet alerts that CVE‑2026‑53366 is a Linux kernel IPv4 memory‑allocation flaw that could allow system compromise, and urges immediate patching.

    0000058
    96 followersView on X
  • VulniPulse@vulnipulse
    Patch

    ⚠️ Red Hat Enterprise Linux 1 alert: CVE-2026-53366 (CVSS 7.0) Refer to the vendor advisory for the confirmed security impact. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/linux-cve-2026-53366 #Linux #RedHatEnterpriseLinux1 #CyberSecurity #CVE

    Post summary

    The advisory urges users of Red Hat Enterprise Linux 1 to upgrade to a vendor‑fixed release, without providing a PoC, exploit code or evidence of active exploitation.

    0000039
    6 followersView on X
  • VulDB 🛡@vuldb
    Active Exploitation

    Attention, elevated activities detected targeting Linux Kernel (CVE-2026-53366) https://vuldb.com/vuln/379468/cti

    Post summary

    Alert notes elevated activity targeting Linux Kernel CVE-2026-53366, indicating that exploitation attempts are occurring in the wild.

    00000129
    2.3K followersView on X
  • OS開発者@hacker_infra
    General

    https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-53366 さっきのカーネルはこれかskbの補正で可用性のみぽいのでするーでいいかな

    Post summary

    The post references CVE‑2026‑53366 but offers no concrete details about proofs of concept, exploits, or patches, leaving its content insufficient for a more specific classification.

    00000133
    2.8K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-53366 Linux Kernel IPv4 Fragmentation Gap Accounting in Paged Allocation Path https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-53366

    Post summary

    The text merely enumerates CVE‑2026‑53366 and its kernel‑level description, directing to a vulnerability detail page, but offers no PoC, exploit, patch, or active‑exploitation information.

    00000131
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
OSlinuxlinux_kernel---

Explore more

Back to dashboardlinux CVEslinux_kernel vulnerabilities