The vulnerability in the Linux kernel's IPv4 code occurs in the __ip_append_data() function when processing fragmented packets using the paged allocation path. The calculations for alloclen and pagedlen did not correctly account for fraggap bytes carried over from previous skb buffers, resulting in an undersized linear area and overstated paged length. The fix aligns the paged allocation branch with the non-paged branch by adjusting alloclen and pagedlen to properly include fraggap, preventing incorrect memory handling during packet reassembly.

The vulnerability could cause improper memory allocation and handling during IPv4 packet fragmentation reassembly, potentially leading to memory corruption or instability in the kernel's network stack. No known exploits in the wild have been reported. The exact impact severity is not quantified by CVSS data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel security advisories for patches addressing CVE-2026-53366 and apply updates accordingly.