Skip to main content

Linux Kernel EUVDEUVD-2026-39892

| CVE-2026-53287 MEDIUM
2026-06-26 Linux GHSA-7w44-35gq-6jc3
Privilege Escalation Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local user access
  2. Delivery
    Call capset() to seed inheritable capability set
  3. Exploit
    Execute target binary with matching file/ambient capability bit
  4. Execution
    Inherit elevated capability post-exec
  5. Persist
    Audit trail records cap_effective as cap_pi, masking the inheritable cap change
  6. Impact
    Forensic analysis fails to reconstruct privilege escalation path

Vulnerability Assessment

Exploitation Conditions

The audit corruption is triggered by any process that calls the capset(2) syscall, which requires at minimum PR:L (local user access). No special kernel configuration, non-default feature flags, or privileged role is required to trigger the incorrect logging - the audit subsystem logs all capability changes automatically when auditd is running. The vulnerability does NOT itself grant elevated privileges; exploitation as an evasion technique requires a secondary privilege escalation vector (inheritable capability abuse via exec) to be meaningful. The limiting factors are: (1) the Linux audit daemon (auditd) must be running and configured to capture CAPSET events, (2) a defender must be relying on CAPSET audit records for forensic analysis or compliance reporting, and (3) the attacker must already have local user access. Systems not running auditd or not monitoring CAPSET records are unaffected in practice since the corrupt field is never consumed.
Impact

The provided CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 5.5 but the A:H metric is analytically inconsistent with the described impact, which is data integrity corruption of audit records rather than a loss of system availability. The realistic impact is audit trail falsification (Integrity), not resource exhaustion or denial of service. EPSS at 0.18% (7th percentile) confirms no observed exploitation pressure. The vulnerability is not listed in CISA KEV. As a standalone vulnerability it does not grant privileges - it is an enabler that makes an already-executed privilege escalation attack harder to detect forensically. The real-world risk is therefore concentrated in environments under active compliance or SOC monitoring that rely on Linux audit logs as a source of truth for capability changes, particularly in hardened environments using capability-based privilege separation. In typical enterprise deployments where CAPSET audit records are not actively parsed, the practical impact is minimal. The bug's 17-year longevity without exploitation suggests low attacker awareness of its audit-evasion utility.
Exploit ScenarioDerived

A local attacker with an unprivileged user account calls capset() to add inheritable capabilities (e.g., CAP_NET_BIND_SERVICE or CAP_SETUID) to their process capability set as a setup step before executing a binary that has the corresponding file capability or ambient capability bit set, gaining elevated privileges post-exec. Because __audit_log_capset() records cap_effective instead of cap_pi, the audit trail shows no change in inheritable capabilities, and a security analyst reviewing CAPSET records post-incident fails to identify this setup step, making the privilege escalation appear to originate from nowhere. No public exploit code exists for this vulnerability.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Silent audit trail corruption in the Linux kernel's capability auditing subsystem allows a local attacker who manipulates inheritable capabilities as a precursor to privilege escalation to have that manipulation go unrecorded in CAPSET audit logs since 2008. The __audit_log_capset() function records cap_effective into the cap_pi (inheritable) field due to a copy-paste error, meaning compliance and forensic systems receive falsified capability state that masks the inheritable-cap modification step of a privilege escalation chain. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects that exploitation as a standalone attack is not observed in the wild.

RemediationAI

Update the Linux kernel to a patched stable release: 7.1, 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.175, 5.15.209, or 5.10.258 depending on the branch in use. Fix commits are available at git.kernel.org for each branch (e.g., https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e for one branch). For systems that cannot be immediately patched, a compensating control is to supplement or replace Linux audit CAPSET records with an independent capability monitoring mechanism such as eBPF-based tracing (e.g., Falco rules on the capset syscall) that reads capability state directly rather than relying on the audit log field. Note that this workaround requires deployment of a separate monitoring stack and does not fix the underlying log corruption. Distributions such as RHEL, Debian, Ubuntu, and SUSE will backport fixes to their kernel packages; consult distribution-specific errata for patched package versions.

Affected VersionsENISA

Linux e68b75a027bb94066576139ee33676264f867b87 <d782e4d200cd9036ef353eeb29525bfbfd13a14e
Linux patch: 7.1
Linux patch: 7.0.10
Linux patch: 6.1.175
Linux e68b75a027bb94066576139ee33676264f867b87 <e35f3550c5b4fab33103c18654c293cee9850b0a
Linux e68b75a027bb94066576139ee33676264f867b87 <95de7bb4bf535a9288549d401ebde83cdcbf2792
Linux patch: 0
Linux patch: 5.10.258
Linux patch: 6.18.33
Linux e68b75a027bb94066576139ee33676264f867b87 <151ee470edc3d7ed29fe72df678f8357d2ad8ced
Linux e68b75a027bb94066576139ee33676264f867b87 <e4a640475e43f406fdfd56d370b1f34b0cbbc18d
Linux e68b75a027bb94066576139ee33676264f867b87 <febb4bf373ac565d3fb8d1f429827bdd983be496
Linux 2.6.29
Linux patch: 6.6.141
Linux e68b75a027bb94066576139ee33676264f867b87 <75bd76c9eb2de9afeca03dc5152ebca5fb8fc816
Linux patch: 5.15.209
Linux e68b75a027bb94066576139ee33676264f867b87 <0a065c51a225854768b772a0b733a44d77162582
Linux patch: 6.12.91

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Linux kernel audit subsystem emits CAPSET records when a process calls the capset(2) syscall to change its capability sets. The function __audit_log_capset() is responsible for capturing and logging the three POSIX capability sets: effective (cap_effective), permitted (cap_permitted), and inheritable (cap_pi). A copy-paste error since the feature's introduction in Linux 2.6.29 (2008) causes the inheritable field in the audit record to be populated with cap_effective rather than cap_pi. Inheritable capabilities are the set passed across exec() calls and are a well-known privilege escalation vector - an attacker who seeds inheritable capabilities before executing a file with the corresponding ambient or file capability bits gains elevated privileges. The CPE identifies the affected product as cpe:2.3:a:linux:linux across all versions from 2.6.29 onward until the patched stable releases. No CWE is formally assigned, but the root cause class is CWE-682 (Incorrect Calculation) or more precisely CWE-20 (Improper Input Validation of data being logged) - functionally a copy-paste substitution of the wrong struct field.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local syscall with low-privilege access corrupts audit record integrity; no confidentiality or availability impact applies.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 08, 2026 - 04:07 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 nvd
MEDIUM 5.5
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

audit: fix incorrect inheritable capability in CAPSET records

__audit_log_capset() records the effective capability set into the inheritable field due to a copy-paste error. Every CAPSET audit record therefore reports cap_pi (process inheritable) with the value of cap_effective instead of cap_inheritable.

This silently corrupts audit data used for compliance and forensic analysis: an attacker who modifies inheritable capabilities to prepare for a privilege-escalating exec would have the change masked in the audit trail.

The bug has been present since the original introduction of CAPSET audit records in 2008.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Ubiquitous
core kernel in all Linux OS deployments worldwide
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53287 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/374374 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22511/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22512/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22522/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22665/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22666/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22699/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2799/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2800/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2914/ REF https://git.kernel.org/stable/c/0a065c51a225854768b772a0b733a44d77162582 REF https://git.kernel.org/stable/c/151ee470edc3d7ed29fe72df678f8357d2ad8ced REF https://git.kernel.org/stable/c/75bd76c9eb2de9afeca03dc5152ebca5fb8fc816 REF https://git.kernel.org/stable/c/95de7bb4bf535a9288549d401ebde83cdcbf2792 REF https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e REF https://git.kernel.org/stable/c/e35f3550c5b4fab33103c18654c293cee9850b0a REF https://git.kernel.org/stable/c/e4a640475e43f406fdfd56d370b1f34b0cbbc18d REF https://git.kernel.org/stable/c/febb4bf373ac565d3fb8d1f429827bdd983be496

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy