Skip to main content

Linux Kernel CVE-2026-53236

| EUVDEUVD-2026-39327 MEDIUM
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-jmmv-2hp7-p7g5
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Side-channel leaks confidential TCP sequence numbers to local unprivileged users, yielding C:H; no integrity or availability impact from passive observation alone.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 13:27 vuln.today
CVSS changed
Jul 08, 2026 - 13:22 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

tcp: restrict SO_ATTACH_FILTER to priv users

This patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets to users with CAP_NET_ADMIN capability.

This blocks potential side-channel attack where an unprivileged application attaches a filter to leak TCP sequence/acknowledgment numbers.

AnalysisAI

TCP socket side-channel information disclosure in the Linux kernel allows unprivileged local users to attach classic BPF (cBPF) filters via SO_ATTACH_FILTER to TCP sockets and observe TCP sequence and acknowledgment numbers, potentially enabling session inference or TCP injection assistance. The vulnerability exists because no capability check was enforced before this patch, which now restricts SO_ATTACH_FILTER on TCP sockets to processes holding CAP_NET_ADMIN. No public exploit identified at time of analysis; EPSS stands at 0.18% (8th percentile), and patched releases are available across multiple stable kernel branches including 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, and 7.1.

Technical ContextAI

The vulnerable component is the Linux kernel TCP socket option handler for SO_ATTACH_FILTER, which permits classic BPF programs to be attached to sockets via setsockopt() for packet inspection and filtering. Prior to the patch, this option was callable by any unprivileged local user on TCP sockets, allowing a crafted cBPF filter program to observe TCP protocol metadata - specifically sequence and acknowledgment numbers that are intended to be opaque to co-resident unprivileged processes. The root cause is a missing authorization gate (closest CWE analogue: CWE-285 Improper Authorization, though CWE is listed as N/A in this entry). The fix adds a CAP_NET_ADMIN capability check before permitting SO_ATTACH_FILTER on TCP sockets. CPE data (cpe:2.3:o:linux:linux_kernel) covers the Linux kernel broadly, with the vulnerability traceable to kernel 2.6.12 per the EUVD affected version list. The technique is related to the broader class of BPF-based side-channel attacks documented in OS security research.

RemediationAI

Upgrade to a patched Linux kernel stable release: 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1, applying the upstream commits available at https://git.kernel.org/stable/c/. Distribution maintainers should apply the relevant stable-branch commits if a backported package has not yet been released. As a compensating control prior to patching, restrict local user access on systems hosting sensitive TCP sessions, and enforce kernel user namespace and network namespace isolation in containerized workloads (e.g., seccomp profiles blocking setsockopt with SO_ATTACH_FILTER, or dropping CAP_NET_ADMIN from container capabilities). Be aware that the patch is a behavioral change: any existing unprivileged application relying on SO_ATTACH_FILTER on TCP sockets will receive EPERM after the fix and will require either CAP_NET_ADMIN grants or refactoring to use unprivileged AF_PACKET or eBPF mechanisms with appropriate permissions.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53236 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy