Skip to content

OSG-SEC-2026-08-28 Important Linux kernel's ipv6 frag escape vulnerability

Dear OSG Security Contacts,

An Important Linux kernel vulnerability, CVE-2026-53362 [1] (ipv6_frag_escape), affecting Red Hat Enterprise Linux (RHEL) 10 has been disclosed. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog [3], indicating exploitation in the wild.

WHAT IS THE VULNERABILITIES:

An incorrect parameter length calculation in the Linux kernel's IPv6 networking subsystem can allow an attacker to overwrite kernel memory, potentially resulting in privilege escalation, data corruption, or a system crash.
Exploitation requires the ability to create network namespaces. Default RHEL 10 configurations provide this capability to unprivileged users through user namespaces.
Exploitation can also be initiated from within a container, potentially allowing an attacker to escape the container, bypass SELinux enforcement, and gain root access to the underlying host.

IMPACTED VERSIONS:

RHEL 10 – Affected
Red Hat products and layered products that rely on an affected RHEL 10 kernel may also be impacted.

MITIGATION

Red Hat has released updated RHEL 10 kernel packages containing a backported fix for CVE-2026-53362 [1].

Sites should identify RHEL 10 instances and verify that the currently running kernel contains the fix. Systems running an affected kernel should apply the applicable RHEL 10 kernel security update and reboot into the updated kernel.

As a temporary mitigation [2], restricting unprivileged user namespaces or network namespaces [4] can reduce the attack surface. On systems where unprivileged user namespaces are not required, they can be disabled at runtime:

sudo sysctl -w user.max_user_namespaces=0

To persist the setting across reboots: echo 'user.max_user_namespaces = 0' | sudo tee /etc/sysctl.d/99-disable-userns.conf

Warning: Disabling unprivileged user namespaces can break functionality that depends on them, including Apptainer containers. Sites that require this functionality should disable network namespaces [4], which can block the documented exploitation path. Prioritize installing the updated kernel and rebooting remains the recommended remediation.

WHAT YOU SHOULD DO:

  • Identify any RHEL 10 systems in your environment.
  • Verify if you are already running a kernel containing Red Hat's backported fix for CVE-2026-53362.
  • Apply the applicable kernel security update,if necessary, and reboot any affected systems.
  • Where immediate patching is not possible, evaluate disabling unprivileged user namespaces or network namespaces after assessing potential operational impact.

REFERENCES

[1] https://access.redhat.com/security/cve/cve-2026-53362
[2] https://access.redhat.com/security/vulnerabilities/RHSB-2026-009
[3] https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[4] https://apptainer.org/docs/admin/latest/user_namespace.html#disabling-network-namespaces

Please contact the OSG security team at [email protected] if you have any questions or concerns.

OSG Security Team