RHSB-2026-009 IPv6 Fragmentation Container Escape - Linux Kernel (CVE-2026-53362) - "ipv6_frag_escape"

Executive Summary

An Important privilege escalation and container escape flaw was found in the Linux kernel's IPv6 networking subsystem. This issue, also referred to as ipv6_frag_escape, has been assigned CVE-2026-53362. A user with local access inside a container could escape to the host, bypassing SELinux enforcement, and gain system administrator (root) access. Red Hat has released fixes for all affected products.
This flaw is distinct from the "Dirty Frag" vulnerabilities addressed in RHSB-2026-003, which affect different subsystems.

Affected Products

The following Red Hat product versions are directly affected:

• Red Hat Enterprise Linux 10 (All fixes released)

OpenShift Container Platform is not affected by this vulnerability because it runs on RHEL 9, which is not impacted.

Further, any Red Hat product that relies on the Red Hat Enterprise Linux kernel, including layered products, is also potentially impacted. Please ensure that the underlying Red Hat Enterprise Linux kernel is current in these product environments.

Technical Details

An incorrect parameter length calculation in the kernel's IPv6 fragmentation path (__ip6_append_data()) causes an out-of-bounds write into skb_shared_info. This flaw can be chained into arbitrary kernel read/write, enabling credential overwrite, SELinux bypass, and container escape.

Mitigation

Exploitation of this vulnerability requires the ability to create network namespaces. Default RHEL 10 configurations provide this capability to unprivileged users through user namespaces. Restricting access to user namespaces reduces the attack surface. The workaround below reduces exposure but does not address the underlying kernel bug. Apply the updated kernel as soon as it is available.

On systems where unprivileged user namespaces are not required, apply the following sysctl to disable them at runtime:

Warning: This setting will break functionality that depends on unprivileged user namespaces, including rootless Podman containers and certain application sandboxes. If your environment depends on these capabilities, prioritize installing the updated kernel instead.

sudo sysctl -w user.max_user_namespaces=0

To persist this setting across reboots:

echo 'user.max_user_namespaces = 0' | sudo tee /etc/sysctl.d/99-disable-userns.conf

To reverse the workaround, delete the sysctl drop-in file and restore the original value (the system default is 65534):

sudo rm /etc/sysctl.d/99-disable-userns.conf
sudo sysctl -w user.max_user_namespaces=65534