Linux Kernel IPv6 __ip6_append_data() Fraggap Out-of-Bounds Write

#!/bin/bash
# CVE-2026-53362 Vulnerability Checker
# Checks running kernel against known fixed versions for the IPv6 fraggap OOB write
# No privileges required. Run on each target Linux host.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

KERNEL_RELEASE=$(uname -r)
echo "[*] CVE-2026-53362 check on kernel: $KERNEL_RELEASE"

# Extract major.minor.patch
VERSION=$(echo "$KERNEL_RELEASE" | grep -oP '^\d+\.\d+\.\d+' || true)

if [ -z "$VERSION" ]; then
    echo "UNKNOWN - Could not parse kernel version from: $KERNEL_RELEASE"
    exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

# Also check if user namespaces are enabled (exploit precondition)
USERNS="unknown"
if [ -r /proc/sys/user/max_user_namespaces ]; then
    MAX_USERNS=$(cat /proc/sys/user/max_user_namespaces)
    if [ "$MAX_USERNS" -eq 0 ] 2>/dev/null; then
        USERNS="disabled (mitigated)"
    else
        USERNS="enabled ($MAX_USERNS) — exploit precondition MET"
    fi
fi

# Check IPv6 status
IPV6="unknown"
if [ -f /proc/net/if_inet6 ]; then
    IPV6="enabled — attack surface present"
else
    IPV6="disabled — attack surface eliminated"
fi

check_vulnerable() {
    echo "VULNERABLE - Kernel $VERSION is affected (fix not applied)"
    echo "  User namespaces: $USERNS"
    echo "  IPv6 status: $IPV6"
    echo "  Fixed versions: 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3"
    exit 1
}

check_patched() {
    echo "PATCHED - Kernel $VERSION contains the fix"
    echo "  User namespaces: $USERNS"
    echo "  IPv6 status: $IPV6"
    exit 0
}

# Vuln introduced in 6.0 (commit 773ba4fe9104, 2022-07-12)
# Not affected: < 6.0
if [ "$MAJOR" -lt 6 ]; then
    echo "PATCHED - Kernel $VERSION predates vulnerable code (introduced in 6.0)"
    exit 0
fi

if [ "$MAJOR" -eq 6 ]; then
    case "$MINOR" in
        0) check_vulnerable ;;  # 6.0.x — EOL, no backport
        1)
            if [ "$PATCH" -ge 177 ]; then check_patched; else check_vulnerable; fi ;;
        2|3|4|5) check_vulnerable ;;  # EOL branches
        6)
            if [ "$PATCH" -ge 144 ]; then check_patched; else check_vulnerable; fi ;;
        7|8|9|10|11) check_vulnerable ;;  # EOL branches
        12)
            if [ "$PATCH" -ge 95 ]; then check_patched; else check_vulnerable; fi ;;
        13|14|15|16|17) check_vulnerable ;;  # EOL branches
        18)
            if [ "$PATCH" -ge 38 ]; then check_patched; else check_vulnerable; fi ;;
        *)
            echo "UNKNOWN - Kernel 6.$MINOR.x not in known fixed-version list; verify manually"
            exit 2 ;;
    esac
elif [ "$MAJOR" -eq 7 ]; then
    case "$MINOR" in
        0) check_vulnerable ;;  # EOL
        1)
            if [ "$PATCH" -ge 3 ]; then check_patched; else check_vulnerable; fi ;;
        *)
            echo "UNKNOWN - Kernel 7.$MINOR.x not in known fixed-version list; verify manually"
            exit 2 ;;
    esac
else
    echo "UNKNOWN - Kernel $MAJOR.x not in known affected/fixed range; verify manually"
    exit 2
fi