Why Your Scanner Won't Warn You About IPv6 Frag Escape

IPv6 Frag Escape (CVE-2026-53362) turns an unprivileged process inside a container into root on the underlying host. A small fragmentation accounting error in the kernel's IPv6 output path undersizes a socket buffer, the copy that follows corrupts kernel memory, and the process chains that mistake into an interactive root shell, writing its own credentials and defanging SELinux while getenforce still reports enforcing. Nothing changes on disk. When this briefing aired there was no CVE and no advisory for scanners to flag, while a tested public proof of concept was already returning host root on Enterprise Linux 10. In this live stream, we break down how the escape crosses the container boundary, why EL10 container hosts deserve particular attention, and what to do when working exploit code moves faster than the usual vulnerability process.