A length miscalculation in Linux IPv6 fragmentation enables container escape

CVE-2026-53362. RHEL 10. CVSS 7.8. On 14 September 2026, Red Hat published a security bulletin for a flaw nicknamed ipv6_frag_escape: an incorrect length calculation in the Linux kernel’s IPv6 fragmentation path produces an out-of-bounds write that lets a local user, from inside a container, escape to the host and bypass SELinux to gain root. Why it matters: this is exactly the class of bug that turns a single compromised pod into a full node takeover.

What the flaw actually does

The vulnerability sits in __ip6_append_data(), the function that assembles outbound IPv6 fragments. When the paged-allocation branch is taken — which happens with MSG_MORE, a NIC advertising NETIF_F_SG, or a large fragment — the kernel computes two lengths: alloclen = fragheaderlen + transhdrlen and pagedlen = datalen - transhdrlen.

The bug is a precise omission: on this paged path, the fragmentation gap (fraggap) is not accounted for in alloclen. The kernel therefore under-allocates the buffer, then writes past its bounds, straight into skb_shared_info, the structure that follows every packet in memory.

The consequence is far from cosmetic. An out-of-bounds write into skb_shared_info can be chained into arbitrary kernel read and write: the attacker overwrites their own credentials, sidesteps SELinux — whose security label travels with the socket — and elevates to root on the host. The CWE-130 classification (Improper Handling of Length Parameter Inconsistency) describes exactly this mechanism.

The exploitation chain

To reach the vulnerable code, an attacker needs two things: the ability to create UDPv6 sockets, and the ability to create network namespaces. The second is the decisive one.

On RHEL 10, the default configuration grants unprivileged users the ability to create user namespaces. A user namespace is enough to create a network namespace — the very mechanism that Podman in rootless mode and most application sandboxes rely on every day. The upshot: a process locked inside a container can assemble the network stack needed for exploitation without any initial root privilege.

The trigger itself goes through a UDPv6 socket driven with the MSG_MORE and MSG_SPLICE_PAGES flags, as the public analysis documents. The combination of the two forces the kernel onto the vulnerable paged branch, where the fraggap is not accounted for. The upstream fix, commit 736b380e28d0 titled “ipv6: account for fraggap on the paged allocation path”, adds precisely that missing accounting.

Why RHEL 10 is the textbook case

Red Hat’s RHSB-2026-009 bulletin names Red Hat Enterprise Linux 10 as the directly affected product, with fixes already released for all affected versions. OpenShift Container Platform is not affected: it runs on RHEL 9, whose kernel does not expose the same path.

The fact that a single major product is affected should not be over-reassuring. Any layered product that consumes the RHEL 10 kernel — base images, appliances, derived distributions — inherits the flaw without its name appearing in the bulletin. Red Hat’s guidance is unambiguous: keep the underlying kernel current, whatever the layered product.

This flaw is distinct from the “Dirty Frag” vulnerabilities covered in RHSB-2026-003 — CVE-2026-43284 (IPsec ESP) and CVE-2026-46300 (XFRM ESP-in-TCP) — which affect different subsystems of the same kernel. Three fragmentation flaws in a single quarter point to a corner of the kernel that has become a favourite hunting ground for researchers and attackers alike.

The mitigation, and what it breaks

Pending the patched kernel, Red Hat offers an interim mitigation: disable unprivileged user namespaces via sysctl.

sudo sysctl -w user.max_user_namespaces=0
echo 'user.max_user_namespaces = 0' | sudo tee /etc/sysctl.d/99-disable-userns.conf

To roll back:

sudo rm /etc/sysctl.d/99-disable-userns.conf
sudo sysctl -w user.max_user_namespaces=65534

This shrinks the attack surface, but it does not fix the underlying bug. And it has a real cost: it breaks Podman in rootless mode, along with application sandboxes that depend on unprivileged user namespaces. It is a decision an operator must make deliberately: on a host that runs only rootless containers, the mitigation is worse than the flaw; on a host that runs none, it is free.

Verdict

CVE-2026-53362 is the kind of flaw a CISO or SRE should address before a public exploit circulates: the out-of-bounds write is documented, the fix is identified, and the class — container-to-host escape — is the one that does the most damage in a multi-tenant environment.

If you run RHEL 10, apply the patched kernel as soon as it reaches your repositories; that is the only real fix. If you run rootless containers with Podman, do not disable user namespaces blindly — prioritise the kernel update instead. If you run non-containerised workloads on RHEL 10 hosts, the user.max_user_namespaces=0 mitigation is a reasonable stopgap while the patch propagates. In every case, audit your network namespaces: they decide whether a local attacker can reach the vulnerable path at all.

References

• Red Hat — RHSB-2026-009 IPv6 Fragmentation Container Escape (CVE-2026-53362)
• Red Hat — CVE-2026-53362
• NVD — CVE-2026-53362
• git.kernel.org — commit 736b380e28d0 “ipv6: account for fraggap on the paged allocation path”
• CISA — Known Exploited Vulnerabilities Catalog
• GridinSoft — CVE-2026-53362: Linux Container Escape Exploited