IPv6 Fragmentation Bug Enables Reliable Container Escape on RHEL 10
A newly disclosed IPv6 fragmentation overflow in the Linux kernel 6.12 series lets an unprivileged process inside a RHEL 10 or CentOS 10 container gain a root shell on the host. The proof‑of‑concept exploits a slab overflow to a use‑after‑free, then hijacks page tables to break out of the jail.