Insufficient Logging in Linux kernel - CVE-2026-53287
Published: June 29, 2026
Vulnerability identifier: #VU135748
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53287
CWE-ID: CWE-778
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to conceal capability changes in audit records.
The vulnerability exists due to incorrect data recording in __audit_log_capset() in the audit subsystem when logging CAPSET operations. A local user can modify inheritable capabilities to conceal capability changes in audit records.
This can mask preparation for a privilege-escalating exec in audit data used for compliance and forensic analysis.
How to mitigate CVE-2026-53287
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/0a065c51a225854768b772a0b733a44d77162582
- https://git.kernel.org/stable/c/151ee470edc3d7ed29fe72df678f8357d2ad8ced
- https://git.kernel.org/stable/c/75bd76c9eb2de9afeca03dc5152ebca5fb8fc816
- https://git.kernel.org/stable/c/95de7bb4bf535a9288549d401ebde83cdcbf2792
- https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e
- https://git.kernel.org/stable/c/e35f3550c5b4fab33103c18654c293cee9850b0a
- https://git.kernel.org/stable/c/e4a640475e43f406fdfd56d370b1f34b0cbbc18d
- https://git.kernel.org/stable/c/febb4bf373ac565d3fb8d1f429827bdd983be496