Cybersecurity Announcement: Linux Kernel Privilege Escalation to Root Vulnerability - IPv6 Frag Escape/Frag Gap (CVE-2026-53362, CVE-2026-53366)

This document is the cybersecurity announcement for the IPV6 Frag Escape/Frag Gap, LPE vulnerabilities.

About the Event

July 4, 2026 - An independent researcher with the handle "qwerty-po" submitted a proof-of concept regarding a flaw within the Linux IPv6 network subsystem (CVE-2026-53362). A matching flaw in the IPv4 network subsystem was submitted on July 16, 2026 (CVE-2026-53366).

Actions to Consider

Both flaws are exploited by forcing the Linux kernel to trigger an out-of-bounds (OOB) write heap overflow within a sk_buff (socket buffer) allocation. They are best mitigated through patching. Backported patches are already available for most affected distributions. Cybersecurity recommends evaluating risk to your environment and patching as soon as possible.

In the event you cannot patch or reboot right away, you can temporarily mitigate by disabling unprivileged user namespaces: 

sudo sysctl -w user.max_user_namespaces=0


These vulnerabilities impact distributions using the unpatched Linux kernel releases in the 6.x line, particularly enterprise setups and rolling-release distributions:

Red Hat Enterprise Linux (RHEL) / CentOS: Vulnerable primarily on RHEL 10 and CentOS 10 branches utilizing the affected 6.x kernel versions. (Older versions like RHEL/CentOS 8 and 9 are largely unaffected by default kernels).
AlmaLinux / Rocky Linux: Early AlmaLinux 10.x builds running unpatched 6.x kernels are vulnerable to container escapes.
Ubuntu / Debian: Any system running mainline kernels from the affected 6.0+ range.
Amazon Linux: Affected when running unpatched 6.x kernel versions.
Affected Kernel Ranges
In mainline Linux, the bad fraggap accounting vulnerabilities specifically affect:
Introduced: Linux Kernel 6.0.
Unaffected/Patched Versions: Linux mainline kernels 6.1.177+, 6.6.144+, 6.12.95+, 6.18.38+, and 7.1.3+.

You can check for this vulnerability in Qualys VMDR with the vulnerability search string: 

vulnerabilities.vulnerability.cveIds:CVE-2026-53362 or vulnerabilities.vulnerability.cveIds:CVE-2026-53366

Note: This will only detect those assets which have the Qualys Cloud Agent running or discovered during an IP scan. Cybersecurity recommends using Cloud Agent detections where possible for maximum fidelity.

Event Impact

An attacker starting as a low-privileged, standard user inside an isolated container can escalate to root privileges on the underlying host machine. There is public Proof-of-Concept code available. There are no reports of it being exploited in the wild.

References


Keywords:
Linux LPE IPv6 Frag Escape Frag Gap Privilege Escalation CVE-2026-53362 CVE-2026-53366 
Doc ID:
162871
Owned by:
Jamie G. in Cybersecurity Testing and Cyber Defense
Created:
2026-07-23
Updated:
2026-07-23
Sites:
Cybersecurity Testing and Cyber Defense, Cybersecurity Vulnerablity Management