CVE-2026-53362

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: account for fraggap on the paged allocation path

In __ip6_append_data(), when the paged-allocation branch is taken

(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are

computed as

alloclen = fragheaderlen + transhdrlen;

pagedlen = datalen - transhdrlen;

datalen already includes fraggap (datalen = length + fraggap). When

fraggap is non-zero, this is not the first skb and transhdrlen is zero.

The fraggap bytes carried over from the previous skb are copied just past

the fragment headers in the new skb's linear area. The linear area is

therefore undersized by fraggap bytes while pagedlen is overstated by the

same amount, and the copy writes past skb->end into the trailing

skb_shared_info.

An unprivileged user can trigger this via a UDPv6 socket using

MSG_MORE together with MSG_SPLICE_PAGES.

The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:

avoid partial copy for zc"). Before commi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References