Greg KH Ships Seven Linux Kernels at Once to Patch a Container-Escape Root Exploit

Greg Kroah-Hartman released seven stable Linux kernels simultaneously on July 4, 2026 — 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, and 5.10.260 — with an unusually direct advisory: upgrade promptly.

The reason is CVE-2026-53362, an IPv6 processing bug introduced in kernel 6.0 that allows a process running inside a container to escape its namespace boundaries and gain root access on the host system. On any server running containerized workloads — Kubernetes clusters, Docker hosts, CI/CD runners — this is the kind of bug that security teams start tracking immediately.

Container escapes are among the highest-severity Linux kernel vulnerabilities because the entire model of containerized infrastructure assumes process isolation is robust. A workload inside a container is supposed to be confined to its namespace; a container-escape vulnerability collapses that boundary and potentially exposes the entire host and its other workloads to a compromised process.

The release also patches a second issue: CVE-2026-53359, a use-after-free in the KVM (Kernel-based Virtual Machine) subsystem that dates to kernel 2.6.36. Use-after-free bugs in hypervisor code are serious because they can allow a guest VM to interfere with the host or other VMs — though this one requires specific conditions to trigger.

The breadth of the release — seven kernels covering more than five years of active stable branches — reflects how seriously the maintainers are treating CVE-2026-53362. Backporting to 5.10 and 5.15 is resource-intensive work that the team reserves for bugs with clear real-world risk. The Long-Term Support branches at 6.1 and 6.6 are widely deployed in embedded systems, network hardware, and enterprise distributions, which amplifies the exposure surface.

For most users on rolling distributions like Arch or Fedora rawhide, the update arrives through normal package channels. For organizations running RHEL, Debian stable, or Ubuntu LTS with pinned kernel versions, the fix requires manual attention and may need to be coordinated with a planned maintenance window.

The LWN.net changelog for this release batch does not specify proof-of-concept availability for CVE-2026-53362, which typically means no working public exploit has been confirmed — but the potential impact alone is enough to justify treating this as urgent. If you're running any kernel between 6.0 and 7.1.2, now is the time to update.