Linux kernel IPv6: heap overwrite into skb_shared_info via UDPv6 MSG_MORE with MSG_SPLICE_PAGES

Impact

On the paged-allocation branch of __ip6_append_data(), alloclen does not account for the fraggap bytes carried over from the previous skb, so the linear area is undersized by exactly that amount and the copy runs past skb->end into the trailing skb_shared_info. An unprivileged local user reaches this from a plain UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES, giving controlled corruption of adjacent kernel heap metadata - the usual starting point for local privilege escalation. This is host-kernel state, not per-container state, so any tenant workload that can open a UDPv6 socket sits one bug-chain away from breaking isolation for every GPU pod scheduled on that node. The record carries a KEV flag, which raises the urgency above the usual local-kernel triage.

Who can reach it

Local unprivileged user with the ability to open a UDPv6 socket - including inside a container, since no capability is required and the path is ordinary sendmsg() flag handling. No authentication beyond code execution on the node.

What to do

Update to a stable kernel containing the fix (the linked git.kernel.org commits) and reboot each node; the corrupted-accounting fix is in packet-path code that livepatching generally will not cover. On a GPU fleet this means draining and rebooting nodes, so batch it with the next kernel maintenance window unless the KEV listing forces it sooner. As a stopgap, blocking MSG_SPLICE_PAGES-capable workloads is not practical - restricting untrusted local code execution is the only real mitigation.

References

Related entries

• Linux FUSE: request not re-locked before page cache folio replacement, giving a use-after-freeCVE-2026-53388 · Linux kernel FUSE (fuse_try_move_folio page cache replacement)High
• libvirt swtpm state handling: symlink following lets the swtpm user take ownership of arbitrary filesCVE-2026-63622 · libvirt (virFileChownFiles over the swtpm state directory)High
• Linux kernel (arch/x86/kvm/svm): The SEV debug-encrypt path bounds each iteration by the source page offset but not theCVE-2026-63794 · Linux kernel (arch/x86/kvm/svm)High
• Linux bpf: sysctl write buffer allocated with kvzalloc but freed with kfree, corrupting memoryCVE-2026-63809 · Linux kernel BPF cgroup sysctl hook (__cgroup_bpf_run_filter_sysctl buffer free)High
• Linux keys: unpinned request_key_auth payload lets KEYCTL_INSTANTIATE race into a use-after-freeCVE-2026-63823 · Linux kernel keyring (request_key_auth payload refcounting)High
• Linux KEYS: miscalculated output buffer length overflows on keyctl asymmetric key operationsCVE-2026-63824 · Linux kernel keyring asymmetric key ops (keyctl_pkey_params_get_2)High