Linux Kernel UDP Corking Flaw Enables Local Privilege Escalation

Two new CVEs (CVE-2026-53362 for IPv6, CVE-2026-53366 for IPv4) describe a heap out-of-bounds write in the Linux kernel's UDP corking path, triggered when a corked datagram crosses a fragment boundary while MSG_SPLICE_PAGES is set. The bug is reachable by a local unprivileged user, for example via splice() from a pipe into a UDP socket under UDP_CORK.

The root cause lies in __ip6_append_data() and its IPv4 counterpart, which count the fraggap bytes past the boundary toward datalen/pagedlen but fail to add them to the linear allocation size (alloclen). This produces a negative 'copy' value that is only rejected when MSG_SPLICE_PAGES is unset, so the check is bypassed and the kernel performs a real linear copy past the end of the data area, writing directly into skb_shared_info. With a controlled 15-byte overwrite, an attacker can manipulate nr_frags to turn a stale frags[0] entry from a prior allocation into an 'allocated' fragment, enabling local privilege escalation.

The IPv6 variant requires CONFIG_IPV6=y; the IPv4 variant requires user namespaces (USERNS). The flawed fraggap accounting has existed since kernel v6.1. Fixes (736b380e28d0 for IPv6, eca856950f7c for IPv4) add fraggap to alloclen, subtract it from pagedlen, and remove the MSG_SPLICE_PAGES exception from the negative-copy check.