Abstract Fraggap (CVE-2026-53362) is a bug in the Linux UDPv6 corking path that allows a 15-byte OOB write into skb_shared_info. The code is here. Vulnerability Summary CONFIG_IPV6=y is required. Two splice() calls overwrite the first 15 bytes of skb_shared_info behind a new skb. The OOB write makes a leftover pipe address on the heap act as frags[0] and then triggers put_page() to create a dangling pipe page. That page is reclaimed as a PTE page so physical memory can be read and written. It rewrites core_pattern to run a root helper. The faulty accounting came in with commit 773ba4fe9104. The current MSG_SPLICE_PAGES trigger became reachable after commit ce650a166335. The IPv6 path was fixed in commit 736b380e28d0. Vulnerability Analysis Overview UDP corking collects several sends into one datagram. A datagram can cross a fragment boundary. Then __ip6_append_data() counts the bytes past the boundary in the previous skb as fraggap and moves them into the linear area of the next skb. The basic skb looks like the following. fraggap is data that will be copied into the linear area. So it must be part of the new skb linear allocation and must be excluded from the length left on the pipe page. The vulnerable code does the opposite. It removes fraggap from the linear data area and puts it into pagedlen. The kernel copies the fraggap bytes into the linear tail without reserving space in the data area. This lets us set the skb_shared_info right behind the tail to any 15 bytes. Setting only the single nr_frags byte to 1 makes the out-of-range frags[0] treat a leftover pipe page address on the heap as an allocated address. Root cause This bug happens because the same bytes are counted differently depending on the path. Building datalen includes fraggap as data the next skb must handle. The paged branch instead treats the same fraggap as part of external data. datalen = length + fraggap; fraglen = datalen + fragheaderlen; pagedlen = 0; else { alloclen = fragheaderlen + transh...
First seen: 2026-07-22 23:53
Last seen: 2026-07-23 10:00