What is the CVSS score of CVE-2026-72243?

CVE-2026-72243 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72243?

A mandatory access control bypass in the Linux kernel's SELinux implementation (CVE-2026-72243) allows unprivileged local users to circumvent network policy enforcement through TCP Fast Open…. A patch is available.

How to fix or mitigate CVE-2026-72243?

Within 24 hours, identify all systems running SELinux with active network policy enforcement and verify their kernel versions against the affected stable branches. Within 7 days, test kernel patches in a staging environment and develop a phased deployment timeline; prioritize systems that enforce network isolation policies for trusted versus untrusted network segments. Within 30 days, complete kernel updates across the infrastructure and validate that SELinux policies are functioning correctly post-patch.

Linux Kernel CVE-2026-72243

EUVD-2026-59142 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-m92q-543g-vq9x

Information Disclosure Linux Red Hat Suse

8.4

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.4 HIGH

Local low-privilege attacker bypasses SELinux MAC via MSG_FASTOPEN; S:C reflects policy enforcement boundary crossed, enabling access to restricted network endpoints.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

5.2 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:53 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.4 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

HIGH 8.4

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

selinux: check connect-related permissions on TCP Fast Open

Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update its socket_sendmsg() hook to call selinux_socket_connect() when MSG_FASTOPEN is passed.

AnalysisAI

SELinux mandatory access control bypass in the Linux kernel allows local low-privilege users to circumvent connect-related network policy enforcement by initiating TCP connections via TCP Fast Open (MSG_FASTOPEN). The kernel's SELinux LSM hook for socket_sendmsg() was never updated to invoke selinux_socket_connect() when the MSG_FASTOPEN flag is passed, meaning connections using this path skip SELinux policy checks entirely. With a CVSS 8.4, Scope Changed, and confirmed patches across six stable branches, this is a meaningful MAC bypass in SELinux-enforcing environments - no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).

Technical ContextAI

TCP Fast Open (TFO, RFC 7413) is a TCP extension that allows payload data to be carried in the SYN packet, reducing round-trip latency for repeat connections. In the Linux kernel, the SELinux LSM enforces network access controls through hook functions; connect-related permissions are normally enforced via selinux_socket_connect(). However, when a socket call uses MSG_FASTOPEN, the kernel paths through socket_sendmsg() rather than the standard connect() syscall path, and the SELinux hook for sendmsg was not wired to invoke selinux_socket_connect(). The root cause is effectively a missing authorization check (analogous to CWE-862) - the permission check exists but is not applied to the MSG_FASTOPEN code path. Affected kernel source spans the security/selinux/hooks.c file. The fix mirrors a similar correction made for Landlock and is confirmed across stable branches 6.1.x, 6.6.x, 6.12.x, 7.1.x, and mainline 7.2-rc3.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.1.178, 6.6.145, 6.12.97, or 7.1.5 for the respective stable branches, or 7.2-rc3 for mainline. Patch commits are referenced at https://git.kernel.org/stable/c/11406d0d7e11b4e525bb2ace2c70107031d058da (and the five additional stable-branch commits listed in the NVD references). If immediate patching is not feasible, disable TCP Fast Open system-wide via sysctl -w net.ipv4.tcp_fastopen=0 (and persist in /etc/sysctl.conf) - this eliminates the bypass path but removes TFO latency benefits for all applications. As an alternative scoped control, if SELinux policy is used primarily for network segmentation, auditing MSG_FASTOPEN usage via auditd rules on socket calls can provide detection coverage while the patch is staged. Setting SELinux to enforcing-but-logging mode (permissive for the relevant domain only) is not a mitigation - it still bypasses the check. Kernel package updates via the distribution's package manager (yum/dnf/apt) are the preferred remediation path for non-source deployments.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72243 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72243

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code