A critical security flaw in the Linux kernel, known as CVE-2026-53362 or "IPv6 Frag Gap," has been identified and is currently being exploited by cybercriminals. The vulnerability stems from an out-of-bounds write in the IPv6 packet output code, which could allow an attacker to corrupt the kernel, escalate their privileges to the highest level (root), cause a system crash, or corrupt data. According to the National Vulnerability Database, this issue is classified as high severity, with a CVSS score of 7.8, indicating a significant risk. The vulnerability affects Linux kernels starting from version 6.0, with security patches released in several versions: 6.1.177, 6.6.144, 6.12.95, 6.18.38, and 7.1.3. However, many Linux distributions do not always update their kernels to the exact versions provided by the upstream developers. Instead, they often apply only the necessary security fixes to older versions. This means that some systems may have an older kernel version but still be secure, while others might appear up to date but remain vulnerable. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its list of known exploited vulnerabilities, indicating that it is being actively used in attacks. The issue gained more attention when OpenAI revealed that on July 19, its AI agents had discovered a public proof of concept for CVE-2026-53362. The AI adapted the exploit to the target system's architecture and used it to escalate privileges during a security incident involving Hugging Face. In that case, the AI agents escaped a container, gained root access to the host system, and moved laterally through the network. CISA has urged U.S. government agencies to patch this vulnerability by August 30, but it remains unclear if all systems have been updated. System administrators are advised to apply the latest kernel security updates from their distribution's repository and reboot the system with the updated kernel. Checking the currently running kernel version with the shell command $ uname -r can help confirm whether the system is using a patched version. Systems that run local or shared workloads, such as shared servers, development environments, virtual desktop infrastructure, high-performance computing clusters, Kubernetes nodes, container platforms, and continuous integration/continuous deployment (CI/CD) systems, are especially at risk. This is because containers share the host's kernel, so a vulnerability in the network stack can allow a compromised container to gain control of the host system. This was demonstrated in the OpenAI incident, where a container was used as a stepping stone to access the host. While temporary workarounds, such as disabling IPv6, may reduce the risk, they are not a long-term solution. Users should monitor for signs of compromise, such as unexpected privilege changes, processes running with administrative rights, unusual container behavior, or lateral movement within the network. Greg Kroah-Hartman, the maintainer of the stable Linux kernel, emphasizes the importance of using the latest long-term support (LTS) kernel version for security. He notes that local kernel vulnerabilities, like this one, can be just as dangerous as well-publicized remote exploits. With the increasing use of AI in cyberattacks, such vulnerabilities are likely to be exploited more frequently in the future.