CISA flags active exploitation of a RHEL 10 container escape; OpenShift is unaffected

CISA has added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog after finding evidence of active exploitation, raising the priority of a Linux kernel flaw that Red Hat says can let a local container user escape to a Red Hat Enterprise Linux 10 host.

The CISA alert lists the kernel vulnerability alongside two other newly cataloged flaws and urges organizations to prioritize remediation of KEV entries. Red Hat rates CVE-2026-53362 Important and says fixes have been released for all affected products.

What is affected

Red Hat's security bulletin identifies RHEL 10 as directly affected. The flaw sits in the kernel's IPv6 fragmentation path, where an incorrect parameter-length calculation can cause an out-of-bounds write. Red Hat says an attacker with local access inside a container can turn that primitive into arbitrary kernel read and write operations, overwrite credentials, bypass SELinux enforcement and gain root access on the host.

There is an important boundary for OpenShift operators: Red Hat says OpenShift Container Platform is not affected because its nodes run on RHEL 9, which is outside the affected set. Other layered Red Hat products may still be exposed when they rely on an affected RHEL 10 kernel, so the underlying host version matters more than whether the application itself ships a vulnerable component.

What teams should do

RHEL 10 administrators should install the updated kernel rather than treating the workaround as an equivalent fix. Red Hat's bulletin says exploitation requires the ability to create network namespaces. Systems that cannot patch immediately can reduce exposure by setting user.max_user_namespaces=0, but that mitigation carries a direct developer-tooling cost: it breaks functionality that depends on unprivileged user namespaces, including rootless Podman containers and some application sandboxes.

That tradeoff makes the patch the cleaner operational response for developer workstations, CI runners and shared container hosts. Teams using the workaround should first inventory rootless-container and sandbox dependencies, then restore the normal namespace setting after the fixed kernel is installed.

The vulnerability has a Red Hat CVSS 3.1 base score of 7.8, with local attack vector, low complexity and low privileges required. CISA's KEV addition does not change the affected product set, but it adds evidence that attackers are using the flaw in practice. For Red Hat environments, the immediate action falls on RHEL 10 container hosts; standard OpenShift nodes do not need a workaround for this CVE.