Linux Kernel EUVD-2026-39892

The Linux kernel audit subsystem emits CAPSET records when a process calls the capset(2) syscall to change its capability sets. The function __audit_log_capset() is responsible for capturing and logging the three POSIX capability sets: effective (cap_effective), permitted (cap_permitted), and inheritable (cap_pi). A copy-paste error since the feature's introduction in Linux 2.6.29 (2008) causes the inheritable field in the audit record to be populated with cap_effective rather than cap_pi. Inheritable capabilities are the set passed across exec() calls and are a well-known privilege escalation vector - an attacker who seeds inheritable capabilities before executing a file with the corresponding ambient or file capability bits gains elevated privileges. The CPE identifies the affected product as cpe:2.3:a:linux:linux across all versions from 2.6.29 onward until the patched stable releases. No CWE is formally assigned, but the root cause class is CWE-682 (Incorrect Calculation) or more precisely CWE-20 (Improper Input Validation of data being logged) - functionally a copy-paste substitution of the wrong struct field.