CVE-2026-63828

In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() only checks AA_MAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP connection that connect(2) would have refused, bypassing connect mediation. Mediate the implicit connect when MSG_FASTOPEN is set and a destination is supplied. Add it to apparmor_socket_sendmsg() (not the shared aa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm() directly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not cover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://git.kernel.org/stable/c/07b71c342382b854ab8030b244aeab6a7228ad7d
https://git.kernel.org/stable/c/20383429b56974507c465d016e5238b189f7a246
https://git.kernel.org/stable/c/45ebb934ea50b436ce49b2f159f090dab0d7fa28
https://git.kernel.org/stable/c/4a69b83045d3195d5b9a9b053ad840ddb2998b4e
https://git.kernel.org/stable/c/4d587cd8a72155089a627130bbd4716ec0856e21
https://git.kernel.org/stable/c/7f57428ce00891d26b0f087ef754a4d820ec83aa
https://git.kernel.org/stable/c/a16714e7cf2baa98ba2efddd5d6cbac641f4e76b
https://git.kernel.org/stable/c/faea60deaa05c76f0772650f42eafde12bd39d93

Configurations

No configuration.

History

No history.

Information

Published : 2026-07-19 12:16

Updated : 2026-08-17 05:17

NVD link : CVE-2026-63828

Mitre link : CVE-2026-63828

CVE.ORG link : CVE-2026-63828

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-63828", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "a16714e7cf2baa98ba2efddd5d6cbac641f4e76b", "versionType": "git"}, {"status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "20383429b56974507c465d016e5238b189f7a246", "versionType": "git"}, {"status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "7f57428ce00891d26b0f087ef754a4d820ec83aa", "versionType": "git"}, {"status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "faea60deaa05c76f0772650f42eafde12bd39d93", "versionType": "git"}, {"status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "07b71c342382b854ab8030b244aeab6a7228ad7d", "versionType": "git"}, {"status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "4a69b83045d3195d5b9a9b053ad840ddb2998b4e", "versionType": "git"}, {"status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "45ebb934ea50b436ce49b2f159f090dab0d7fa28", "versionType": "git"}, {"status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "4d587cd8a72155089a627130bbd4716ec0856e21", "versionType": "git"}], "programFiles": ["security/apparmor/lsm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.6"}, {"status": "unaffected", "version": "0", "lessThan": "3.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.177", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.144", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.95", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.38", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.3", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["security/apparmor/lsm.c"], "defaultStatus": "affected"}]}], "published": "2026-07-19T12:16:56.110", "references": [{"url": "https://git.kernel.org/stable/c/07b71c342382b854ab8030b244aeab6a7228ad7d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/20383429b56974507c465d016e5238b189f7a246", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/45ebb934ea50b436ce49b2f159f090dab0d7fa28", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4a69b83045d3195d5b9a9b053ad840ddb2998b4e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4d587cd8a72155089a627130bbd4716ec0856e21", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7f57428ce00891d26b0f087ef754a4d820ec83aa", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a16714e7cf2baa98ba2efddd5d6cbac641f4e76b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/faea60deaa05c76f0772650f42eafde12bd39d93", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: mediate the implicit connect of TCP fast open sendmsg\n\nsendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and\nwrite(2): it opens the connection in the SYN. apparmor_socket_sendmsg()\nonly checks AA_MAY_SEND, so a profile that grants send but denies connect\nlets a confined task open an outbound TCP/MPTCP connection that connect(2)\nwould have refused, bypassing connect mediation.\n\nMediate the implicit connect when MSG_FASTOPEN is set and a destination\nis supplied. Add it to apparmor_socket_sendmsg() (not the shared\naa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm()\ndirectly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not\ncover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit."}], "lastModified": "2026-08-17T05:17:20.497", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}