CVE-2026-53366
CVE CVE-2026-53366EUVD EUVD-2026-44868Published 2026-07-16T05:13:40.000ZLast changed 2026-08-05T12:35:14.000ZCVSS 7.8
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap, but the fraggap bytes carried over from the previous skb are copied into the new skb's linear area at offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 8eb77cc73977d88787b37c92831b1c242e035396 <ce494707a9c07f27c219ca67f3e138061f53d9b3; patch: 7.2-rc1; 8eb77cc73977d88787b37c92831b1c242e035396 <a9c24eda24bd15f432e37824e6fc440977cb241c; patch: 0; patch: 6.18.38; patch: 6.6.144; 8eb77cc73977d88787b37c92831b1c242e035396 <77798d7be6ef71e72fb6fc8a2901bf74ebc9706f; 8eb77cc73977d88787b37c92831b1c242e035396 <eca856950f7cb1a221e02b99d758409f2c5cec42; patch: 6.1.178; 6.0; patch: 7.1.3; patch: 6.12.95; 8eb77cc73977d88787b37c92831b1c242e035396 <c04d9ece23deb9e26c19f9ca215e98b3295aa1bb; 8eb77cc73977d88787b37c92831b1c242e035396 <5c6375bced6147ec2e460ee3b653f4860d5ecdc2
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.