An IPv6 UDP fragmentation bug turns a local socket into Linux kernel privilege escalation

An out-of-bounds write in the Linux kernel’s IPv6 UDP fragment handling, rated CVSS 7.8, lets a local attacker escalate privileges and is already being exploited — CISA added it to the KEV catalog on 27 August 2026. Patch the kernel before 30 August and treat IPv6 as something you monitor, not just route.