These advisory covers two vulnerabilities in the IPv6 networking subsystem of the Linux kernel. Both permit an unprivileged local user to escalate privileges. They are addressed together because they affect the same subsystem and are resolved by the same remediation.

CVE-2026-66384 was flagged on 27 August 2026 on the basis of confirmed exploitation in the wild. [GAP IN SOURCE DOCUMENT] of low risk, and should disregard any third-party analysis that purports to describe the flaw in detail unless it is corroborated by a distribution vendor.

CVE-2026-53362 is a separate, documented flaw in the same subsystem, published on 4 July 2026, carrying a CVSS v3.1 Base Score of 7.8 and rated by Red Hat as having Important security impact.

CERTVU has not been able to establish from the available information whether these two records describe the same underlying defect, related defects, or entirely distinct ones. That distinction does not affect the action required, as the same kernel update resolves both.

The documented flaw is a container escape, not merely a privilege escalation.

Red Hat has stated that a user with local access inside a container could escape to the host, bypass SELinux enforcement, and gain system administrator access on the host itself. Containers are frequently relied upon as a security boundary, on the understanding that a compromise inside a container is contained to that container. This removes that assumption.

The practical consequence is that a single compromised containerised application can yield root on the host and, through it, access to every other container running on that host. Where the host forms part of a shared platform, the exposure extends to workloads belonging to other applications, departments or customers.

The kernel is shared between the host and all containers running on it, so updating an individual container image does not address either issue. The host kernel must be updated and the host restarted.

• Linux kernels containing the vulnerable code paths in the IPv6 networking subsystem, prior to the versions in which the fixes were applied – Affected
• Kernels carrying the upstream fixes or the vendor-backported fixes supplied by the distribution – Not affected, patched

Not all distributions and releases are affected by both issues. Some older releases do not contain the vulnerable code at all, and vendors differ in which of their supported releases require an update.

CERTVU recommends the following:

1. Determine Exposure From Your Distribution Vendor

   Check the running kernel version on each host, then confirm against your vendor's advisories for CVE-2026-66384 and CVE-2026-53362 whether that release is affected and which kernel package resolves each issue.

   uname -r

2. Update the Host Kernel and Reboot

   Apply the current kernel package supplied by your distribution vendor. A kernel update does not take effect until the system is restarted, so a host that has been patched but not rebooted remains fully exploitable. Verify after rebooting that the running kernel is the updated one.

Other mitigating options include:

• Prioritize Container Hosts and Shared Platforms
• Conduct a Compromise Assessment, Not Only a Patch
• Consider Disabling IPv6 Where It Is Not Required

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.