CVE-2026-53362
published 2026-07-04CVE-2026-53362: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the…
PriorityP279high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-08-30
Exploited in the wild
EPSS
0.71%
53.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.
An unprivileged user can trigger this via a UDPv6 socket using
MSG_MORE together with MSG_SPLICE_PAGES.
The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:
avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix
__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative
copy value caused -EINVAL to be returned. That later commit allowed
MSG_SPLICE_PAGES to proceed in this case, making the corruption
triggerable.
The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.
After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES
case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 < 14200d435af9a9eeb444f529fc2f689a236b7962 | 14200d435af9a9eeb444f529fc2f689a236b7962 |
| linux | linux | >= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 < 65fb14cbebb0cd0eff903a22d33537ddc8b95769 | 65fb14cbebb0cd0eff903a22d33537ddc8b95769 |
| linux | linux | >= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 < 46f201f8b4c39633a1fa3dc12459f506d470993d | 46f201f8b4c39633a1fa3dc12459f506d470993d |
| linux | linux | >= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 < 6374fb9edf72c67a118a2c214a0dddd04c921e0a | 6374fb9edf72c67a118a2c214a0dddd04c921e0a |
| linux | linux | >= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 < e9eacf19281ea2498b36291b56c9606118c2d74e | e9eacf19281ea2498b36291b56c9606118c2d74e |
| linux | linux | >= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 < 736b380e28d0480c7bc3e022f1950f31fe53a7c5 | 736b380e28d0480c7bc3e022f1950f31fe53a7c5 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.0 < 6.1.177 | 6.1.177 |
| linux | linux_kernel | >= 6.13 < 6.18.38 | 6.18.38 |
| linux | linux_kernel | >= 6.19 < 7.1.3 | 7.1.3 |
| linux | linux_kernel | >= 6.2 < 6.6.144 | 6.6.144 |
| linux | linux_kernel | >= 6.7 < 6.12.95 | 6.12.95 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-aws-7.0 | — | — |
| ubuntu | linux-aws-fips | — | — |
| ubuntu | linux-azure | — | — |
| ubuntu | linux-azure-7.0 | — | — |
| ubuntu | linux-azure-fde | — | — |
| ubuntu | linux-azure-fde-7.0 | — | — |
| ubuntu | linux-azure-fips | — | — |
| ubuntu | linux-fips | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-gcp-7.0 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck7.8HIGH
cisa7.8HIGH
vendor_ubuntu9.1CRITICAL
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.1.2 ipv6 __ip6_append_data end allocation of resources (EUVD-2026-41669)
vuldb·2026-07-04
CVE-2026-53362 [CRITICAL] Linux Kernel up to 7.1.2 ipv6 __ip6_append_data end allocation of resources (EUVD-2026-41669)
A vulnerability has been found in Linux Kernel up to 6.1.176/6.6.143/6.12.94/6.18.37/7.1.2 and classified as critical. This affects the function __ip6_append_data of the component ipv6. Performing a manipulation of the argument end results in allocation of resources.
This vulnerability was named CVE-2026-53362. The attack needs to be approached within the local network. There is no available exploit.
The affected component should be upgraded.
GHSA
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE
ghsa_unreviewed·2026-07-04
CVE-2026-53362 In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.
An unprivileg
VulnCheck
Linux Kernel Unspecified Vulnerability
vulncheck·2026·CVSS 7.8
CVE-2026-53362 [HIGH] Linux Kernel Unspecified Vulnerability
Linux Kernel Unspecified Vulnerability
Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.
Affected: Linux Kernel
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 pat
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-10-13·CVSS 5.6
CVE-2026-72197 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly perform Reverse
Map Table (RMP) checks when the IOMMU accessed certain host buffers. A
local attacker with hypervisor access could possibly use this to trigger an
out-of-bounds condition and compromise the integrity of SEV-SNP guest
memory. (CVE-2023-20585)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- NVDIMM (Non-Volatile Memory Device) drivers;
- Handshake API;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 archite
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-10-13·CVSS 5.6
CVE-2026-72213 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly perform Reverse
Map Table (RMP) checks when the IOMMU accessed certain host buffers. A
local attacker with hypervisor access could possibly use this to trigger an
out-of-bounds condition and compromise the integrity of SEV-SNP guest
memory. (CVE-2023-20585)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- NVDIMM (Non-Volatile Memory Device) drivers;
- Handshake API;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
-
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-10-06
CVE-2026-80576 Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- NVDIMM (Non-Volatile Memory Device) drivers;
- Handshake API;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- OpenRISC architecture;
- PowerPC architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- Android drivers;
- Rados block device (RBD) driver;
- Bluetooth drivers;
- Hardware random number generator core;
- TPM device driver;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- DMA engin
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-09-29·CVSS 9.1
CVE-2026-64191 [CRITICAL] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were d
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architecture;
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 9.1
CVE-2026-52938 [CRITICAL] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were di
Ubuntu
Linux kernel (NVIDIA BaseOS) vulnerabilities
vendor_ubuntu·2026-09-22
CVE-2026-64504 Linux kernel (NVIDIA BaseOS) vulnerabilities
Title: Linux kernel (NVIDIA BaseOS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- Intel NPU Driver;
- ACPI drivers;
- Android drivers;
- Drivers core;
- Compressed RAM block device driver;
- Bluetooth drivers;
- Character device driver;
- Hardware random number generator core;
- CPU frequency scaling framework;
- Hardware crypto device drivers
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 9.1
CVE-2026-53361 [CRITICAL] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Character device driver;
- Networking core;
- IPv6 networking;
- Unix domain sockets;
(CVE-2026-52938, CVE-2026-53325, CVE
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2026-09-21·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architec
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-09-18·CVSS 9.1
CVE-2026-64504 [CRITICAL] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-09-15
CVE-2026-63869 Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- Intel NPU Driver;
- ACPI drivers;
- Android drivers;
- Drivers core;
- Compressed RAM block device driver;
- Bluetooth drivers;
- Character device driver;
- Hardware random number generator core;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- Buf
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-52938 [CRITICAL] Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were disc
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-64504 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architecture;
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architec
CISA
Linux Kernel Unspecified Vulnerability
cisa·2026-08-27·CVSS 7.8
CVE-2026-53362 [HIGH] Linux Kernel Unspecified Vulnerability
Vulnerability: Linux Kernel Unspecified Vulnerability
Affected: Linux Kernel
Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to
Red Hat
kernel: kernel: ipv6 frag escape
vendor_redhat·2026-06-21·CVSS 7.8
CVE-2026-53362 [HIGH] CWE-130 kernel: kernel: ipv6 frag escape
kernel: kernel: ipv6 frag escape
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
s
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-53362 kernel: ipv6: account for fraggap on the paged allocation path
bugzilla·2026-07-04
CVE-2026-53362 [HIGH] CVE-2026-53362 kernel: ipv6: account for fraggap on the paged allocation path
CVE-2026-53362 kernel: ipv6: account for fraggap on the paged allocation path
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and
Bugzilla
CVE-2026-53362 kernel: kernel: ipv6 frag escape
bugzilla·2026-07-01
CVE-2026-53362 [HIGH] CVE-2026-53362 kernel: kernel: ipv6 frag escape
CVE-2026-53362 kernel: kernel: ipv6 frag escape
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.
An unprivileged user can trigger this via a UDPv6 socket using
MSG_MORE together with MSG
Hackernews
OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face
blogs_hackernews·2026-08-28
CVE-2026-53362 OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face
OpenAI on Wednesday revealed that reward hacking was a key driver behind the artificial intelligence (AI)-powered hack of Hugging Face last month, adding that it found evidence of misaligned behavior as early as late May.
The incident, the company said, took place during cybersecurity evaluations of several OpenAI models, and that it was mainly fueled by what it described as a "highly capable, internal-only research model" comparable in scale to GPT‑5.6 Sol.
"The models, operating under reduced safeguards, took actions that were misalign
Hackernews
ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body
blogs_hackernews·2026-08-28·CVSS 9.8
CVE-2023-49105 [CRITICAL] ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities ( KEV ) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines.
The vulnerability, tracked as CVE-2023-49105 (CVSS score: 9.8), is a case of WebDAV API authentication bypass that could allow an attacker to access, modify or delete any file without authentication if the username of the victim is k
https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993dhttps://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0ahttps://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74ehttps://cert-portal.siemens.com/productcert/html/ssa-784472.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362
2026-07-04
Published
2026-08-27
Added to CISA KEV
Exploited in the wild