Main Vulnerability Database Vulnerabilities #VU138819

Improper access control in Linux kernel - CVE-2026-63828

Published: July 20, 2026

Vulnerability identifier: #VU138819

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-63828

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to bypass AppArmor connect restrictions.

The vulnerability exists due to improper access control in apparmor_socket_sendmsg() when processing sendmsg()/sendto() calls with MSG_FASTOPEN and a supplied destination address. A local user can send a crafted fast open request to bypass AppArmor connect restrictions.

The issue affects implicit TCP and MPTCP connection establishment performed as part of sendmsg() fast open handling.

Affected software

Linux kernel

How to mitigate CVE-2026-63828

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3

External References

Related Security Bulletins