Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-53362 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Year | 2026 |
| Publication Date | 2026-08-27 |
| Vendor | Linux |
| Product | Linux kernel (IPv6 subsystem) |
| CVSS Score | 7.8 (High) |
| EPSS Score | 0.3% (percentile: 18%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Due Date | 2026-08-30 |
Vulnerability Description
Source: CISA KEV / NVD
The Linux kernel contains a vulnerability in the IPv6 networking subsystem that allows privilege escalation. The flaw is in __ip6_append_data(): when the paged-allocation branch is taken (MSG_MORE, NETIF_F_SG, or a large fraglen), alloclen and pagedlen are computed without accounting for fraggap. The mismatch between the reserved and the actually written amount of data leads to memory corruption.
The vulnerability affects multiple Linux-based products — CISA names SUSE and Red Hat among others, but the scope is not limited to them.
A note on EPSS: the 0.3% score is misleading here. Fresh CVEs have no meaningful EPSS score computed yet, while KEV status means exploitation has been confirmed in the field. KEV decides, not EPSS.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 “Prioritizing Security Updates Based on Risk” guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
In practice: apply the kernel update from your distribution vendor and reboot. If a reboot has to wait, check whether your distribution offers live patching.
CISA’s deadline for US federal agencies: 2026-08-30.
Who Is Affected?
The vulnerability affects systems running a Linux kernel with IPv6 support — that is, virtually every modern installation, including those where IPv6 is not used deliberately, because the stack remains enabled by default.
In practice this means application servers, database servers, Kubernetes nodes and virtualisation hosts on RHEL, SLES, Ubuntu and Debian. If your organisation runs a separate patching cycle for production systems, this vulnerability belongs in the next maintenance window, not the next quarter.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
