Skip to main content

Linux Kernel EUVDEUVD-2026-45494

| CVE-2026-63828 HIGH
2026-07-19 Linux GHSA-fvhv-v8p3-vrwq
Authentication Bypass Linux
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
vuln.today AI
5.2 MEDIUM

Local confined process required (AV:L/PR:L); scope changes as it defeats the LSM's egress policy (S:C), but real impact is limited policy bypass, not direct high C/I compromise.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:45 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.4 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 8.4
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

apparmor: mediate the implicit connect of TCP fast open sendmsg

sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() only checks AA_MAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP connection that connect(2) would have refused, bypassing connect mediation.

Mediate the implicit connect when MSG_FASTOPEN is set and a destination is supplied. Add it to apparmor_socket_sendmsg() (not the shared aa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm() directly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not cover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit.

AnalysisAI

AppArmor connect mediation bypass in the Linux kernel lets a confined task open outbound TCP or MPTCP connections using TCP Fast Open (MSG_FASTOPEN on sendmsg()/sendto()) even when its profile grants send but denies connect. Because apparmor_socket_sendmsg() only checked AA_MAY_SEND, the implicit connect embedded in the SYN packet escaped policy enforcement, effectively an authentication/authorization bypass of the profile. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and this is not in CISA KEV, so risk is a targeted policy-enforcement gap rather than mass exploitation.

Technical ContextAI

The affected component is AppArmor, the Linux Security Module (LSM) that mediates process capabilities including socket operations. TCP Fast Open (RFC 7413) allows data to be carried in the initial SYN, so a single sendmsg()/sendto() call with the MSG_FASTOPEN flag performs both the connect(2) and the write(2) atomically. AppArmor's socket hooks split these into distinct permissions (AA_MAY_CONNECT vs AA_MAY_SEND), but apparmor_socket_sendmsg() historically validated only AA_MAY_SEND, so the connect implied by fast open was never checked against the profile. The fix mediates the implicit connect when MSG_FASTOPEN is set and a destination is supplied, calling aa_sk_perm() directly inside apparmor_socket_sendmsg() rather than the shared aa_sock_msg_perm() helper (which recvmsg also uses), and explicitly handles the SOCK_STREAM/IPPROTO_MPTCP case because sk_is_tcp() does not cover MPTCP fast open. This mirrors equivalent fixes previously made in SELinux and TOMOYO. No CWE was assigned in the input, but the root-cause class is improper authorization / incomplete mediation of a security-relevant operation.

RemediationAI

Upgrade to a fixed stable kernel: Vendor-released patch available in 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, or 7.2-rc1 (or your distribution's backported equivalent) - apply the release matching your kernel series and reboot. The upstream fixes are the stable commits at https://git.kernel.org/stable/c/7f57428ce00891d26b0f087ef754a4d820ec83aa (and the sibling commits faea60deaa05, 07b71c342382, 4a69b83045d3, 45ebb934ea50, 4d587cd8a721). If patching must be deferred, the practical compensating control is to disable TCP Fast Open at the host level via sysctl (net.ipv4.tcp_fastopen=0), which closes the MSG_FASTOPEN path entirely; the trade-off is loss of the latency benefit of TFO for legitimate clients and servers. Alternatively, do not rely on AppArmor send-without-connect profiles to enforce egress restrictions until patched, and enforce network egress at the firewall/netfilter layer instead, which does not depend on the LSM hook and is unaffected by this bug.

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45494 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy