The Linux kernel IPv6 vulnerability (CVE-2026-53362) arises from improper accounting of the fragment gap (fraggap) in the __ip6_append_data() function's paged allocation path. When fraggap is non-zero, the linear area allocated is too small, and the paged length is overstated, causing a copy operation to write beyond the skb buffer boundary into adjacent memory (skb_shared_info). This memory corruption can be triggered by an unprivileged user via a UDPv6 socket using the MSG_MORE flag combined with MSG_SPLICE_PAGES. The vulnerability was introduced by a commit that allowed MSG_SPLICE_PAGES to proceed even when copy values were negative, which previously caused the operation to fail. The patch corrects the length calculations to include fraggap properly, eliminating the buffer overflow condition and removing exceptions related to negative copy values.

This vulnerability allows an unprivileged user to cause a buffer overflow in kernel memory by sending specially crafted UDPv6 packets with MSG_MORE and MSG_SPLICE_PAGES flags. The overflow writes past the skb buffer into adjacent kernel memory structures, potentially leading to memory corruption. The exact impact (e.g., privilege escalation, denial of service) is not detailed in the provided data. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel security advisories for patches addressing CVE-2026-53362. Until a patch is applied, consider restricting unprivileged user access to UDPv6 sockets or disabling MSG_SPLICE_PAGES usage if feasible to reduce risk.