OpenAI 'ın aracıları, Hugging Face olayda yamalı bir Linux hatasından yararlandı
Özgün başlık: OpenAI's agents exploited a patched Linux bug in Hugging Face incident
A patched Linux kernel vulnerability in the IPv6 network stack is drawing renewed attention after OpenAI's agents exploited it.
When Greg Kroah-Hartman, the Linux stable kernel maintainer, says you should always use the latest long-term stable (LTS) kernel if you want your Linux system to be secure, you should listen. Take, for example, the recently patched CVE-2026-53362 vulnerability.
CVE-2026-53362, aka IPv6 Frag Gap or “Fraggap,” is an out-of-bounds write vulnerability in the Linux kernel’s IPv6 packet-output code. As a result, the kernel can allocate a buffer that s too small and then copy data past its end, overwriting the adjacent skb_shared_info structure. This security vulnerability can cause kernel heap corruption, a class of bug that can support local privilege escalation, denial of service, or data corruption.
Also: Linux is getting a security wake-up call – why it was inevitable, and I’m not worried
The vulnerable path is reachable from an unprivileged process using an IPv6 UDP socket with MSG_MORE and MSG_SPLICE_PAGES, under fragmentation and scatter-gather conditions. In other words, this is not a conventional internet-facing remote-code-execution flaw. Instead, an attacker needs local code execution or a foothold inside a workload.
As bugs go, this is bad, but it s not awful. The National Vulnerability Database lists the issue as a high-severity vulnerability with a CVSS score of 7.
8.
The flaw was publicly fixed upstream earlier this summer, but many people didn t patch it. That was a mistake. The security hole is now being exploited. On Aug. 27, the US Cybersecurity and Infrastructure Security Agency (CISA) added the exploit to the group s Known Exploited Vulnerabilities (KEV) catalog . The title says it all. These are bugs hackers are using in the real world to launch attacks. Lucky us.
Attention intensified on this bug after OpenAI disclosed that, on July 19, some of its agents found a public proof-of-concept for CVE-2026-53362.