CVE-2026-53362: Linux Kernel Vulnerability in CISA KEV Catalog Due to Active Exploitation

CVE-2026-53362: Linux Kernel Vulnerability in CISA KEV Catalog Due to Active Exploitation

In short

CVE-2026-53362 is a Linux kernel vulnerability, located in the IPv6 networking subsystem, with a CVSS score of 7.8 (high severity according to NVD) [1] and published on July 4, 2026 [1]. CISA has added it to its catalog of actively exploited vulnerabilities (KEV), confirming that it is already being used in real-world attacks, not just a theoretical risk [2]. It affects systems based on the Linux kernel [1]. If your company operates servers, containers, or devices with this kernel, what you need to do today is confirm whether your systems have the patch that fixes this flaw applied, and prioritize the equipment with the highest network exposure.

What it is and why it matters

The flaw lies in the internal function that the Linux kernel uses to build outgoing IPv6 packets (__ip6_append_data()). According to the official technical description, when the paged allocation path is used—typical when combining the MSG_MORE flag with MSG_SPLICE_PAGES on a UDP socket over IPv6—the calculation of the reserved memory size is miscounted, and the kernel ends up writing data beyond the end of the reserved buffer, corrupting adjacent internal structures [1]. What's relevant for a company is that, according to that same description, a user without special privileges can trigger this memory corruption simply by opening a UDPv6 socket and using those options [1]. Our internal intelligence team (OCIRIA radar), based on this same NVD and CISA KEV data, classifies this case within its internal "privilege escalation" category and assigns it a critical follow-up priority, above the "high" severity rating given by NVD, precisely because it combines a flaw triggerable without privileges with exploitation already confirmed in the real world. This is an internal OCIRIA risk assessment, not an additional official rating from NVD or CISA.

Who is affected

The affected component identified in the official record is the Linux kernel [1]. Since the Linux kernel is the common base of numerous enterprise distributions, any organization managing servers, virtualization infrastructure, or devices with Linux should review this advisory, regardless of the specific distribution used (SUSE, Red Hat, or others rely on the same kernel). We do not have verified data on exactly which kernel versions or which distributions have already released the patch, so that detail needs to be confirmed with each system's vendor.

How to know if you are vulnerable

• Check the Linux kernel version installed on your servers and cross-reference it with your distribution's security advisory for CVE-2026-53362 [1].
• Identify which services in your organization open UDP sockets over IPv6, since that is the specific vector described for triggering the flaw [1].
• Since this CVE is listed in the CISA KEV catalog, treat it as a high priority in your pending patch inventory, not just another entry in the usual queue [2].

How to protect yourself

1. Apply the kernel update or your distribution's package that fixes CVE-2026-53362 as soon as possible, starting with the most critical servers or those with the greatest network exposure.

2. If you cannot patch immediately, consider restricting or monitoring UDP traffic over IPv6 to your most sensitive systems as a temporary measure.

3. Add this CVE to your vulnerability management process with the "confirmed active exploitation" (KEV) label, so that it is not deprioritized in favor of other findings with lower actual risk [2].

4. Verify that your kernel patch deployment processes cover all environments (cloud, on-premise, containers), not just traditional servers.

Frequently asked questions

Is this vulnerability being actively exploited?

Yes. CISA includes it in its KEV catalog of vulnerabilities with confirmed exploitation [2].

What severity does the official source assign it?

NVD assigns it a CVSS of 7.8, corresponding to high severity [1].

Do I need administrator privileges to be affected?

Not necessarily to trigger it: the official technical description indicates that a user without special privileges can cause the flaw via a UDPv6 socket with the MSG_MORE and MSG_SPLICE_PAGES options [1].

Which Linux distributions are confirmed as affected?

The official record identifies the Linux kernel as the affected component [1]; for exact versions and patches by distribution, it is advisable to consult your vendor's specific advisory.

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-53362
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json