Fraggap Linux Kernel Vulnerability: Full Details and PoC Exploit Code Now Public

A researcher has published full technical details and working proof-of-concept code for a Linux kernel vulnerability named Fraggap. Tracked as CVE-2026-53362, the bug lives in the kernel’s UDPv6 networking path. A local attacker can abuse it to gain root. Because the details and PoC are now public, the risk to unpatched systems rises sharply.

TL;DR

Fraggap is a small out-of-bounds write in the Linux kernel UDPv6 code. It leads to full local privilege escalation. The researcher qwerty has released both a detailed writeup and a public exploit, so defenders should patch without delay.

Why it matters

Local privilege escalation flaws turn a foothold into full control. An attacker who already runs code as a normal user can become root. On shared servers and containers, that jump is serious.

Public proof-of-concept code raises the stakes further. Once an exploit circulates, the barrier to abuse drops. You can read the researcher’s full technical writeup of the Fraggap vulnerability for the deep analysis.

How the attack works

At its core, this Linux kernel vulnerability is an accounting error. It appears when UDP corking spans a fragment boundary. The kernel miscounts a small “fraggap” of leftover bytes. As a result, it copies those bytes without reserving space for them.

The mismatch allows a 15-byte out-of-bounds write into an adjacent kernel structure. From there, the researcher shows how that tiny write becomes a path to arbitrary physical memory access. The final step rewrites a kernel setting to run a root helper. Notably, the flaw requires IPv6 support to be enabled in the kernel.

We are not publishing exploit steps or code here. Instead, we point readers to the vendor patch and the researcher’s analysis.

Affected versions

The bug affects Linux kernels that carry the faulty UDPv6 corking logic with IPv6 enabled. The researcher demonstrated the exploit against a recent long-term-support kernel build. Both the IPv6 and the matching IPv4 accounting paths were affected before the fixes landed. Check your distribution’s advisory for the exact patched package version.

Patch and mitigation steps

Update your kernel to a fixed release. The upstream fix corrects the byte accounting so the leftover bytes are handled consistently. The IPv6 fix also removes the flawed check that let the write slip through.

• Apply your distribution’s latest kernel update as soon as it is available.
• Reboot to load the patched kernel, or use live patching where supported.
• Where patching must wait, restrict untrusted local code and container escape paths.

The researcher also notes that restricting splice() can help, but calls it a poor option. Therefore, patching remains the right fix. The public Fraggap proof-of-concept on GitHub underscores why speed matters. No in-the-wild exploitation has been confirmed at this time.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.