Linux UDP corking bugs yield local root on kernels since 6.1
Two heap out-of-bounds writes in fragment-boundary handling are exploitable for privilege escalation, and public exploits are out.
Two Linux kernel flaws in UDP corking allow a local unprivileged user to escalate to root on systems running 6.1 and later. Both produce a controlled 15-byte heap out-of-bounds write when a corked datagram crosses a fragment boundary under MSG_SPLICE_PAGES, for example via splice from a pipe into a corked UDP socket.
CVE-2026-53362 covers the IPv6 path and requires only that IPv6 support be built in. CVE-2026-53366 is the same root cause on IPv4 and needs user namespaces. Wongi Lee and a researcher using the handle physicube found the issues; Sultan Alsawaf confirmed the IPv4 case is exploitable.
Fixes landed upstream some time ago, but the IPv4 variant was only recently shown to be a full privilege-escalation bug and assigned its own CVE. Distributions that backported independently may want to verify both fixes are present. Public exploits for the IPv6 issue are already available, including one published by the discoverers.
Alexander Peslyak of Openwall noted the careful disclosure, including advance notice to distributions, and checked that RHEL 10 carried both patches.