Description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.
An unprivileged user can trigger this via a UDPv6 socket using
MSG_MORE together with MSG_SPLICE_PAGES.
The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:
avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix
__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative
copy value caused -EINVAL to be returned. That later commit allowed
MSG_SPLICE_PAGES to proceed in this case, making the corruption
triggerable.
The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.
After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES
case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.0 | 6.1.177 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.1.3-1 | — |
| Debian 13 | linux | 6.12.95-1 | — |
| Debian 12 | linux | 6.1.177-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | 6.8.0-1033.38 | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-31.31 | USN-8726-1 |
| Ubuntu 26.04 LTS | linux-aws | 7.0.0-1012.12 | USN-8726-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1014.14 | USN-8726-4 |
| Ubuntu 26.04 LTS | linux-gcp +1 | 7.0.0-1011.11 | USN-8726-4, USN-8726-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1006.7 | USN-8726-1 |
| Ubuntu 26.04 LTS | linux-ibm +2 | 7.0.0-1013.13 | USN-8801-1, USN-8727-1, USN-8726-3 |
| Ubuntu 26.04 LTS | linux-nvidia | 7.0.0-1018.18 | USN-8760-2 |
| Ubuntu 26.04 LTS | linux-nvidia-bos | 7.0.0-2018.18 | USN-8800-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1019.19 | USN-8726-2 |
| Ubuntu 26.04 LTS | linux-riscv +1 | 7.0.0-31.31.1 | USN-8726-1 |
| Ubuntu 25.10 | linux +8 | No fix yet | — |
| Ubuntu 24.04 LTS | linux | 6.8.0-147.147 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-aws +1 | 6.8.0-1067.70 | USN-9024-1, USN-8917-1 |
| Ubuntu 24.04 LTS | linux-aws-7.0 | 7.0.0-1012.12~24.04.1 | USN-8726-1 |
| Ubuntu 24.04 LTS | linux-azure-7.0 | 7.0.0-1014.14~24.04.1 | USN-8728-2 |
| Ubuntu 24.04 LTS | linux-azure-fde | 6.8.0-1069.76 | USN-8918-1 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1013.13~24.04.1 | USN-8801-1 |
| Ubuntu 24.04 LTS | linux-gcp +1 | 6.8.0-1071.79 | USN-8918-1, USN-8917-1 |
| Ubuntu 24.04 LTS | linux-gcp-7.0 +1 | 7.0.0-1011.11~24.04.1 | USN-8728-3, USN-8728-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1066.74 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1052.56 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-31.31~24.04.1 | USN-8726-1 |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1067.68 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-lowlatency | 6.8.0-147.147.1 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-nvidia-7.0 | 7.0.0-1018.18~24.04.1 | USN-8760-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1067.70.1 | USN-9040-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1036.39 | USN-8886-1 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1064.67 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1068.72 | USN-9025-1 |
| Ubuntu 24.04 LTS | linux-riscv +29 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-31.31.1~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-vmware | 6.8.0-1008.8 | — |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1069.74~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1073.82~22.04.1 | USN-9026-1 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.8 | 6.8.0-1071.78~22.04.1 | USN-9026-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1073.81~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-149.149~22.04.1 | USN-9066-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1069.70~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.8 | 6.8.0-149.149.1~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1067.71~22.04.1 | USN-9025-1 |
| Ubuntu 22.04 LTS | linux-riscv +33 | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2056.58 | USN-9025-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1062.63 | USN-8917-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1064.65~22.04.1 | USN-9024-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-aws-fips | 6.8.0-1067.70+fips1 | USN-8917-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-147.147+fips1 | USN-8917-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-gcp-fips +1 | 6.8.0-1071.79+fips1 | USN-8918-1, USN-8917-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | kpatch-patch-6_12_0-211_16_1 | 1-4.el10_2 | RHSA-2026:43826 |
| RHEL 10 | rv +76 | 6.12.0-211.30.1.el10_2 | RHSA-2026:34911 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +6 | 6.4.0-150700.53.66.1 | SUSE-SU-2026:3166-1, SUSE-SU-2026:2800-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.66.1.150700.17.39.1 | SUSE-SU-2026:3166-1, SUSE-SU-2026:2800-1 |
| SLES 15 SP7 | kernel-docs | 6.4.0-150700.53.66.2 | SUSE-SU-2026:3166-1, SUSE-SU-2026:2800-1 |
| SLES 15 SP6 | kernel-64kb +6 | 6.4.0-150600.23.125.1 | SUSE-SU-2026:3156-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.125.1.150600.12.58.3 | SUSE-SU-2026:3156-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.36.1 | SUSE-SU-2026:22835-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22835-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_0 | 15-160000.4.3 | SUSE-SU-2026:22872-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_1 | 13-160000.1.1 | SUSE-SU-2026:22864-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_12 +1 | 2-160000.1.1 | SUSE-SU-2026:22871-1, SUSE-SU-2026:22866-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_13 | 2-160000.1.2 | SUSE-SU-2026:22879-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_2 | 11-160000.1.1 | SUSE-SU-2026:22876-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_3 | 10-160000.1.1 | SUSE-SU-2026:22869-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_4 | 9-160000.1.1 | SUSE-SU-2026:22867-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_5 | 8-160000.1.1 | SUSE-SU-2026:22874-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_6 | 7-160000.1.1 | SUSE-SU-2026:22873-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_7 | 6-160000.1.1 | SUSE-SU-2026:22868-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_8 | 5-160000.1.1 | SUSE-SU-2026:22875-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_9 +2 | 4-160000.1.1 | SUSE-SU-2026:22877-1, SUSE-SU-2026:22870-1, SUSE-SU-2026:22865-1 |
| SLES for SAP 15 SP6 | kernel-default-base | 6.4.0-150600.23.125.1.150600.12.58.3 | SUSE-SU-2026:3156-1 |
| SLES for SAP 15 SP6 | kernel-docs +4 | 6.4.0-150600.23.125.1 | SUSE-SU-2026:3156-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.36.1 | SUSE-SU-2026:22835-1, SUSE-SU-2026:22812-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22835-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_0 | 15-160000.4.3 | SUSE-SU-2026:22872-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_1 | 13-160000.1.1 | SUSE-SU-2026:22864-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_12 +1 | 2-160000.1.1 | SUSE-SU-2026:22871-1, SUSE-SU-2026:22866-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_13 | 2-160000.1.2 | SUSE-SU-2026:22879-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_2 | 11-160000.1.1 | SUSE-SU-2026:22876-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_3 | 10-160000.1.1 | SUSE-SU-2026:22869-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_4 | 9-160000.1.1 | SUSE-SU-2026:22867-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_5 | 8-160000.1.1 | SUSE-SU-2026:22874-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_6 | 7-160000.1.1 | SUSE-SU-2026:22873-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_7 | 6-160000.1.1 | SUSE-SU-2026:22868-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_8 | 5-160000.1.1 | SUSE-SU-2026:22875-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_9 +2 | 4-160000.1.1 | SUSE-SU-2026:22877-1, SUSE-SU-2026:22870-1, SUSE-SU-2026:22865-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22769-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16-RT_Update_0 | 13-160000.3.4 | SUSE-SU-2026:22785-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16-RT_Update_1 | 12-160000.1.1 | SUSE-SU-2026:22784-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_0 | 15-160000.4.3 | SUSE-SU-2026:22755-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_1 | 13-160000.1.1 | SUSE-SU-2026:22743-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_12 +4 | 2-160000.1.1 | SUSE-SU-2026:22779-1, SUSE-SU-2026:22774-1, SUSE-SU-2026:22773-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_13 | 2-160000.1.2 | SUSE-SU-2026:22766-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_2 | 11-160000.1.1 | SUSE-SU-2026:22761-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_3 +1 | 10-160000.1.1 | SUSE-SU-2026:22783-1, SUSE-SU-2026:22748-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_4 +2 | 9-160000.1.1 | SUSE-SU-2026:22786-1, SUSE-SU-2026:22782-1, SUSE-SU-2026:22746-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_5 +1 | 8-160000.1.1 | SUSE-SU-2026:22778-1, SUSE-SU-2026:22759-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_6 +1 | 7-160000.1.1 | SUSE-SU-2026:22777-1, SUSE-SU-2026:22758-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_7 +1 | 6-160000.1.1 | SUSE-SU-2026:22776-1, SUSE-SU-2026:22747-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_8 +1 | 5-160000.1.1 | SUSE-SU-2026:22781-1, SUSE-SU-2026:22762-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_9 +5 | 4-160000.1.1 | SUSE-SU-2026:22780-1, SUSE-SU-2026:22775-1, SUSE-SU-2026:22763-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.36.1 | SUSE-SU-2026:22769-1, SUSE-SU-2026:22742-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0-RT_Update_10 | 18-1.1 | SUSE-SU-2026:22914-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0-RT_Update_13 +1 | 9-1.1 | SUSE-SU-2026:22696-1, SUSE-SU-2026:22689-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0-RT_Update_22 | 3-1.2 | SUSE-SU-2026:22695-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0-RT_Update_9 | 18-1.2 | SUSE-SU-2026:22912-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_10 +1 | 14-1.1 | SUSE-SU-2026:22915-1, SUSE-SU-2026:22673-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_11 +2 | 13-1.1 | SUSE-SU-2026:22913-1, SUSE-SU-2026:22675-1, SUSE-SU-2026:22674-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_13 | 11-1.1 | SUSE-SU-2026:22676-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_14 | 9-1.2 | SUSE-SU-2026:22682-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_16 +1 | 8-1.1 | SUSE-SU-2026:22690-1, SUSE-SU-2026:22677-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_17 +1 | 7-1.1 | SUSE-SU-2026:22691-1, SUSE-SU-2026:22683-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_18 +1 | 6-1.1 | SUSE-SU-2026:22692-1, SUSE-SU-2026:22684-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_19 +1 | 4-1.1 | SUSE-SU-2026:22693-1, SUSE-SU-2026:22685-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_20 +5 | 3-1.1 | SUSE-SU-2026:22697-1, SUSE-SU-2026:22694-1, SUSE-SU-2026:22687-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_24 +3 | 2-1.1 | SUSE-SU-2026:23100-1, SUSE-SU-2026:23079-1, SUSE-SU-2026:22698-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_8 +1 | 20-1.2 | SUSE-SU-2026:22681-1, SUSE-SU-2026:22680-1 |
| SLE Micro 6.1 | kernel-rt +4 | 6.4.0-49.1 | SUSE-SU-2026:22904-1, SUSE-SU-2026:22903-1, SUSE-SU-2026:22666-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0-RT_Update_10 | 18-1.1 | SUSE-SU-2026:22794-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0-RT_Update_13 +1 | 9-1.1 | SUSE-SU-2026:22725-1, SUSE-SU-2026:22711-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0-RT_Update_22 | 3-1.2 | SUSE-SU-2026:22717-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0-RT_Update_9 | 18-1.2 | SUSE-SU-2026:22792-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_10 +1 | 14-1.1 | SUSE-SU-2026:22795-1, SUSE-SU-2026:22718-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_11 +2 | 13-1.1 | SUSE-SU-2026:22793-1, SUSE-SU-2026:22720-1, SUSE-SU-2026:22719-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_13 | 11-1.1 | SUSE-SU-2026:22721-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_14 | 9-1.2 | SUSE-SU-2026:22730-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_16 +1 | 8-1.1 | SUSE-SU-2026:22722-1, SUSE-SU-2026:22712-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_17 +1 | 7-1.1 | SUSE-SU-2026:22731-1, SUSE-SU-2026:22713-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_18 +1 | 6-1.1 | SUSE-SU-2026:22732-1, SUSE-SU-2026:22714-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_19 +1 | 4-1.1 | SUSE-SU-2026:22733-1, SUSE-SU-2026:22715-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_20 +5 | 3-1.1 | SUSE-SU-2026:22735-1, SUSE-SU-2026:22734-1, SUSE-SU-2026:22726-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_24 +3 | 2-1.1 | SUSE-SU-2026:23031-1, SUSE-SU-2026:23010-1, SUSE-SU-2026:22727-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_8 +1 | 20-1.2 | SUSE-SU-2026:22729-1, SUSE-SU-2026:22728-1 |
| SLE Micro 6.0 | kernel-rt +4 | 6.4.0-49.1 | SUSE-SU-2026:22810-1, SUSE-SU-2026:22809-1, SUSE-SU-2026:22522-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.66.1 | SUSE-SU-2026:3166-1, SUSE-SU-2026:2800-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_11 | 6-150700.2.1 | SUSE-SU-2026:2855-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_17 | 1-150700.1.3.1 | SUSE-SU-2026:2799-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_18 | 1-150700.1.5.1 | SUSE-SU-2026:3130-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_8 | 9-150700.2.1 | SUSE-SU-2026:2857-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_9 | 8-150700.2.1 | SUSE-SU-2026:2858-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_1 | 19-150700.2.2 | SUSE-SU-2026:2930-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_10 +1 | 6-150700.2.2 | SUSE-SU-2026:2956-1, SUSE-SU-2026:2945-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_12 | 5-150700.2.2 | SUSE-SU-2026:2887-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_14 | 3-150700.2.2 | SUSE-SU-2026:2943-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_15 +1 | 2-150700.2.2 | SUSE-SU-2026:3083-1, SUSE-SU-2026:3075-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_17 +2 | 2-150700.2.1 | SUSE-SU-2026:3369-1, SUSE-SU-2026:2863-1, SUSE-SU-2026:2862-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_18 | 1-150700.15.3.1 | SUSE-SU-2026:2800-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_19 | 1-150700.15.3.4 | SUSE-SU-2026:3166-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_7 | 9-150700.2.2 | SUSE-SU-2026:2902-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_9 | 8-150700.2.2 | SUSE-SU-2026:2895-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.125.1 | SUSE-SU-2026:3156-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_12 | 20-150600.2.2 | SUSE-SU-2026:2894-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_13 | 18-150600.2.2 | SUSE-SU-2026:2902-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_22 | 6-150600.2.2 | SUSE-SU-2026:2866-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_23 | 5-150600.2.2 | SUSE-SU-2026:2957-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_25 +1 | 3-150600.2.2 | SUSE-SU-2026:2997-1, SUSE-SU-2026:2945-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_27 +1 | 2-150600.2.2 | SUSE-SU-2026:3008-1, SUSE-SU-2026:3002-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_29 | 1-150600.13.7.1 | SUSE-SU-2026:3156-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +2 | 6.4.0-150700.7.62.1 | SUSE-SU-2026:3130-1, SUSE-SU-2026:2799-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 7.1.3-1.1 | openSUSE-SU-2026:11214-1 |
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | openSUSE-SU-2026:21388-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.36.1 | openSUSE-SU-2026:21388-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.36-69.136 +2 | 1:1.0-0.amzn2023 | ALAS2023-2026-1938, ALAS2023-2026-1937, ALAS2023-2026-1936 |
| Amazon Linux 2023 | perf +11 | 1:6.1.176-220.360.amzn2023 | ALAS2023-2026-1936 |
| Amazon Linux 2023 | perf6.12 +11 | 1:6.12.94-123.176.amzn2023 | ALAS2023-2026-1937 |
| Amazon Linux 2023 | perf6.18 +12 | 1:6.18.36-69.136.amzn2023 | ALAS2023-2026-1938 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.144.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rv +29 | 6.12.0-211.34.1.el10_2 | ELSA-2026-34911 |
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-204.92.4.3.el10uek | ELSA-2026-500150, ELSA-2026-500004 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
sol4ce503/cve-2026-53362-ipv6-frag-escape ★ 0 · Nov 7, 2026
-
suominen/ipv6_frag_escape ★ 0 · Jul 3, 2026
Tracking IPV6_FRAG_ESCAPE (CVE-2026-53362, CVE-2026-53366), the IPv6 fragmentation container escape
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 50
- USN-9066-1 linux-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9024-1 linux-aws-6.8, linux-gcp-6.8, linux-ibm-6.8, linux-lowlatency-hwe-6.8, linux-nvidia, linux-realtime-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9026-1 linux-azure-6.8, linux-azure-fde-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- WID-SEC-2026-2208 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-9040-1 linux-nvidia-lowlatency vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8917-1 linux, linux-aws, linux-aws-fips, linux-fips, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-ibm, linux-lowlatency, linux-oracle, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9025-1 linux-oracle-6.8, linux-raspi, linux-raspi-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8726-1 linux, linux-aws, linux-aws-7.0, linux-gcp, linux-gke, linux-hwe-7.0, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8726-4 linux-azure, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8918-1 linux-azure, linux-azure-fde, linux-azure-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8728-1 linux-gcp-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8728-2 linux-azure-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8760-1 linux-nvidia-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8800-1 linux-nvidia-bos vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8728-3 linux-oracle-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8760-2 linux-nvidia vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8886-1 linux-nvidia-tegra vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8726-3 linux-ibm vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8727-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8726-2 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8801-1 linux-azure-fde, linux-azure-fde-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- ICSA-26-295-16 Siemens SIMATIC S7-1500 TM MFP CISA ICS & IT advisories · Oct 22, 2026
- WID-SEC-2026-3891 Siemens SIMATIC S7: Mehrere Schwachstelle BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2026:43826 Red Hat Security Advisory: kpatch-patch-6_12_0-211_16_1 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:34911 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- SSA-784472 SSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1 Siemens ProductCERT · Oct 13, 2026
- SUSE-SU-2026:22689-1 Security update for the Linux Kernel RT (Live Patch 13 for SUSE Linux Enterprise Micro 6.0) SUSE / openSUSE Security Updates · Oct 1, 2026
- SUSE-SU-2026:22711-1 Security update for the Linux Kernel RT (Live Patch 13 for SUSE Linux Enterprise Micro 6.0) SUSE / openSUSE Security Updates · Oct 1, 2026
- SUSE-SU-2026:23100-1 Security update for the Linux Kernel RT (Live Patch 25 for SUSE Linux Enterprise Micro 6.0) SUSE / openSUSE Security Updates · Aug 14, 2026
- SUSE-SU-2026:23079-1 Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise Micro 6.0) SUSE / openSUSE Security Updates · Aug 14, 2026
- SUSE-SU-2026:23031-1 Security update for the Linux Kernel RT (Live Patch 25 for SUSE Linux Enterprise Micro 6.0) SUSE / openSUSE Security Updates · Aug 12, 2026
- SUSE-SU-2026:23010-1 Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise Micro 6.0) SUSE / openSUSE Security Updates · Aug 12, 2026
- ELSA-2026-34911 Important: kernel security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 10, 2026
- ELSA-2026-500150 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 8, 2026
- ALAS2023-2026-1938 Important: kernel6.18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 29, 2026
- ALAS2023-2026-1936 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 29, 2026
- ALAS2023-2026-1937 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 29, 2026
- SUSE-SU-2026:3369-1 Security update for the Linux Kernel (Live Patch 17 for SUSE Linux Enterprise 15 SP7) SUSE / openSUSE Security Updates · Jul 29, 2026
- SUSE-SU-2026:22903-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22904-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22915-1 Security update for the Linux Kernel RT (Live Patch 11 for SUSE Linux Enterprise Micro 6.0) SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22912-1 Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise Micro 6.0) SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22913-1 Security update for the Linux Kernel RT (Live Patch 12 for SUSE Linux Enterprise Micro 6.0) SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22914-1 Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise Micro 6.0) SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22876-1 Security update for the Linux Kernel (Live Patch 2 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22877-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22879-1 Security update for the Linux Kernel (Live Patch 13 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22872-1 Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22873-1 Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22874-1 Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Jul 28, 2026
References
- https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962
- https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769
- https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d
- https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a
- https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e
- https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5