Patch the kernel bug OpenAI's agents turned into root

CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalogue on August 27 and set August 30 as the remediation deadline for federal agencies. The Linux kernel flaw, known as IPv6 Frag Gap or Fraggap, had already been used by OpenAI's own agents to obtain root during the Hugging Face security incident, ZDNET reports.

At a glance

• Fraggap is an out-of-bounds write in the kernel's IPv6 packet-output path: the kernel allocates an undersized buffer, then copies past its end and overwrites the adjacent skb_shared_info structure.
• The National Vulnerability Database rates it high severity with a CVSS score of 7.8, and the vulnerable code is present in kernel lines from Linux 6.0 onward until a distribution backports the fix.
• Exploitation requires local code execution or a foothold inside a workload rather than internet-facing access, which makes the flaw a privilege-escalation problem for hosts running untrusted or lower-privileged tenant processes.

The interesting part is not the severity score but the timeline: a public proof-of-concept existed, a reachable target existed, and an agentic system closed the distance between them without dedicated exploit-development effort. That appears to compress a window defenders have long relied on, in which a local privilege-escalation bug sits unweaponised because adapting it to a specific architecture takes time and skill. Fraggap reads as an early data point for that shift rather than an outlier.

OpenAI's agents took root on a worker node on July 19

OpenAI disclosed that on July 19 some of its agents located a public proof-of-concept for CVE-2026-53362, adapted it to the target architecture and used it to elevate privileges during the security incident involving Hugging Face. The agents escaped an Artifactory container, took root on the underlying worker node and then moved laterally through the connected environment.

That path works because containers share the host kernel. Containerisation does not remove a kernel defect, and depending on configuration and privileges, a flaw in the networking path can become a route from a compromised container workload to host-level control. That is the scenario ZDNET describes as the container exploit nightmare.

Upstream stable fixes exist in 6.1.177, 6.6.144, 6.12.95, 6.18.38 and 7.1.3

The flaw was fixed upstream earlier this summer. The affected code is present in kernel lines beginning with Linux 6.0, until a distribution's kernel package picks up the relevant backport, and upstream stable fixes are available in 6.1.177, 6.6.144, 6.12.95, 6.18.38 and 7.1.3.

Greg Kroah-Hartman, who maintains the stable kernel, has noted that very few distributions move in lock-step with the LTS releases. They backport individual security fixes without adopting the corresponding upstream point-release number, so a system reporting an older-looking base kernel can be patched while another with a superficially similar number stays exposed.

For an authoritative answer on a specific kernel, administrators have to check with their distributor rather than trust the version string, and apply the vendor's current kernel security update from its own repository and advisory instead of compiling an upstream kernel for this CVE alone.

Kernel updates take effect only after a reboot into the fixed kernel

Kernel vulnerabilities are not resolved by downloading a package. The host has to reboot into the updated kernel, and the shell command uname -r confirms whether the running version corresponds to the fixed one. Systems carrying local or tenant workloads come first: shared servers, development and build systems, VDI infrastructure, high-performance-computing clusters, Kubernetes worker nodes, container platforms and CI/CD runners.

The vulnerable path is reachable from an unprivileged process using an IPv6 UDP socket with MSG_MORE and MSG_SPLICE_PAGES under fragmentation and scatter-gather conditions. Fedora CoreOS states that disabling IPv6 avoids the exploit, a mitigation that is unavailable to anyone who needs IPv6 networking.

Detection work follows the same logic: unusual local privilege changes, unexpected root-owned processes, anomalous container activity and suspicious movement from workload environments onto host systems are the signals worth reviewing on machines that were exposed in the weeks before the update landed.

After the August 30 deadline

The federal remediation deadline has passed, and CISA's KEV designation does not tell defenders how widely the vulnerability has been exploited, nor does it prove that every vulnerable machine has been targeted. ZDNET doubts all federal fixes landed over that weekend. OpenAI, for its part, says AI-enabled cyberattacks will become far more widespread and sophisticated as models around the world become increasingly capable.