On a recent day, the linux-cve-announce mailing list saw the publication of 432 new reports detailing vulnerabilities in the Linux kernel, each assigned a CVE identifier. Among these reports, one particular vulnerability named Frag Gap stands out. It has been confirmed that an exploit exists that allows an unprivileged local user to gain root privileges on the system.
The vulnerability, identified by CVE-2026-53362 in IPv6 and CVE-2026-5336 in IPv4 kernel stacks, is caused by an out-of-bounds write in the fragmented UDP packet handler. Exploiting the vulnerability involves sending a segment of data larger than the permissible fragment size through a UDP socket with the UDP_CORK option set. This triggers an issue during the processing of data that needs to be split into fragments, leading to potential memory corruption.
The vulnerability affects kernel version 6.1 and onwards. A fix was recently accepted into the kernel on June 21 and has been included in corrective releases such as 7.1.3, 6.18.38, 6.12.95, 6.6.144,