CVE-2026-63828

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63828", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.014Z", "datePublished": "2026-07-19T12:02:22.644Z", "dateUpdated": "2026-08-17T04:51:36.839Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:51:36.839Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: mediate the implicit connect of TCP fast open sendmsg\n\nsendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and\nwrite(2): it opens the connection in the SYN. apparmor_socket_sendmsg()\nonly checks AA_MAY_SEND, so a profile that grants send but denies connect\nlets a confined task open an outbound TCP/MPTCP connection that connect(2)\nwould have refused, bypassing connect mediation.\n\nMediate the implicit connect when MSG_FASTOPEN is set and a destination\nis supplied. Add it to apparmor_socket_sendmsg() (not the shared\naa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm()\ndirectly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not\ncover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires a confined local process to invoke sendmsg(2)/sendto(2) with MSG_FASTOPEN; the vulnerable AppArmor LSM hook runs on the syscall path before TCP fast-open performs its implicit connect.\nAC:L - Any confined task that already has send permission can reliably trigger the bypass with a single sendmsg/sendto call using MSG_FASTOPEN and a destination address, with no race or special victim state required beyond TCP Fast Open client support.\nPR:L - The attacker must be an unprivileged process confined by an AppArmor profile that grants network send but denies connect (e.g., hardened Snap/sandboxed service profiles on Ubuntu); no real root or capabilities beyond normal confined-user execution are needed.\nUI:N - No victim interaction is required; the confined attacker process directly issues the bypassing syscall without needing another user or administrator to perform any action.\nS:C - Successful exploitation crosses the AppArmor confinement boundary, allowing a sandboxed task to establish outbound TCP/MPTCP connections that connect(2) mediation would have blocked, escaping the intended network policy scope.\nC:H - Bypassing connect mediation lets a confined process open TCP/MPTCP sessions to destinations policy forbids and read arbitrary response data from those services (internal APIs, metadata endpoints, C2 servers), constituting unauthorized information disclosure.\nI:H - The bypass enables unauthorized outbound connection establishment and transmission of arbitrary application data (including SYN-cookie data) to hosts explicitly denied by the AppArmor connect rule, violating integrity of the confinement policy.\nA:N - This is a pure LSM policy-bypass flaw with no kernel memory corruption, panic, oops, hang, or resource exhaustion; exploitation does not impact system availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/apparmor/lsm.c"], "versions": [{"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "a16714e7cf2baa98ba2efddd5d6cbac641f4e76b", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "20383429b56974507c465d016e5238b189f7a246", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "7f57428ce00891d26b0f087ef754a4d820ec83aa", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "faea60deaa05c76f0772650f42eafde12bd39d93", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "07b71c342382b854ab8030b244aeab6a7228ad7d", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "4a69b83045d3195d5b9a9b053ad840ddb2998b4e", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "45ebb934ea50b436ce49b2f159f090dab0d7fa28", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "4d587cd8a72155089a627130bbd4716ec0856e21", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/apparmor/lsm.c"], "versions": [{"version": "3.6", "status": "affected"}, {"version": "0", "lessThan": "3.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.177", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.144", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.1.177"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.6.144"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.18.38"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.1.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a16714e7cf2baa98ba2efddd5d6cbac641f4e76b"}, {"url": "https://git.kernel.org/stable/c/20383429b56974507c465d016e5238b189f7a246"}, {"url": "https://git.kernel.org/stable/c/7f57428ce00891d26b0f087ef754a4d820ec83aa"}, {"url": "https://git.kernel.org/stable/c/faea60deaa05c76f0772650f42eafde12bd39d93"}, {"url": "https://git.kernel.org/stable/c/07b71c342382b854ab8030b244aeab6a7228ad7d"}, {"url": "https://git.kernel.org/stable/c/4a69b83045d3195d5b9a9b053ad840ddb2998b4e"}, {"url": "https://git.kernel.org/stable/c/45ebb934ea50b436ce49b2f159f090dab0d7fa28"}, {"url": "https://git.kernel.org/stable/c/4d587cd8a72155089a627130bbd4716ec0856e21"}], "title": "apparmor: mediate the implicit connect of TCP fast open sendmsg", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["security/apparmor/lsm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a16714e7cf2baa98ba2efddd5d6cbac641f4e76b", "status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "versionType": "git"}, {"lessThan": "20383429b56974507c465d016e5238b189f7a246", "status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "versionType": "git"}, {"lessThan": "7f57428ce00891d26b0f087ef754a4d820ec83aa", "status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "versionType": "git"}, {"lessThan": "faea60deaa05c76f0772650f42eafde12bd39d93", "status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "versionType": "git"}, {"lessThan": "07b71c342382b854ab8030b244aeab6a7228ad7d", "status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "versionType": "git"}, {"lessThan": "4a69b83045d3195d5b9a9b053ad840ddb2998b4e", "status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "versionType": "git"}, {"lessThan": "45ebb934ea50b436ce49b2f159f090dab0d7fa28", "status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "versionType": "git"}, {"lessThan": "4d587cd8a72155089a627130bbd4716ec0856e21", "status": "affected", "version": "cf60af03ca4e71134206809ea892e49b92a88896", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["security/apparmor/lsm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.6"}, {"lessThan": "3.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.177", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.144", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.95", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.38", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: mediate the implicit connect of TCP fast open sendmsg\n\nsendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and\nwrite(2): it opens the connection in the SYN. apparmor_socket_sendmsg()\nonly checks AA_MAY_SEND, so a profile that grants send but denies connect\nlets a confined task open an outbound TCP/MPTCP connection that connect(2)\nwould have refused, bypassing connect mediation.\n\nMediate the implicit connect when MSG_FASTOPEN is set and a destination\nis supplied. Add it to apparmor_socket_sendmsg() (not the shared\naa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm()\ndirectly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not\ncover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit."}], "id": "CVE-2026-63828", "lastModified": "2026-08-17T05:17:20.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 5.8, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T12:16:56.110", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07b71c342382b854ab8030b244aeab6a7228ad7d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20383429b56974507c465d016e5238b189f7a246"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/45ebb934ea50b436ce49b2f159f090dab0d7fa28"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4a69b83045d3195d5b9a9b053ad840ddb2998b4e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4d587cd8a72155089a627130bbd4716ec0856e21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f57428ce00891d26b0f087ef754a4d820ec83aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a16714e7cf2baa98ba2efddd5d6cbac641f4e76b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/faea60deaa05c76f0772650f42eafde12bd39d93"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: apparmor: mediate the implicit connect of TCP fast open sendmsg", "id": "2502242", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502242"}, "csaw": false, "cwe": "CWE-1220", "details": ["In the Linux kernel, the following vulnerability has been resolved:\napparmor: mediate the implicit connect of TCP fast open sendmsg\nsendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and\nwrite(2): it opens the connection in the SYN. apparmor_socket_sendmsg()\nonly checks AA_MAY_SEND, so a profile that grants send but denies connect\nlets a confined task open an outbound TCP/MPTCP connection that connect(2)\nwould have refused, bypassing connect mediation.\nMediate the implicit connect when MSG_FASTOPEN is set and a destination\nis supplied. Add it to apparmor_socket_sendmsg() (not the shared\naa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm()\ndirectly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not\ncover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit.", "A flaw was found in the Linux kernel's AppArmor security module. A local user, confined by an AppArmor profile that grants send permission but denies connect permission, can bypass the intended security mediation. This bypass occurs when using sendmsg() or sendto() with the MSG_FASTOPEN flag, allowing the confined task to establish outbound TCP/MPTCP connections that should have been blocked. This could lead to unauthorized network activity from a supposedly restricted application."], "name": "CVE-2026-63828", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63828\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63828\nhttps://lore.kernel.org/linux-cve-announce/2026071907-CVE-2026-63828-c436@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,7f57428ce00891d26b0f087ef754a4d820ec83aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,faea60deaa05c76f0772650f42eafde12bd39d93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,07b71c342382b854ab8030b244aeab6a7228ad7d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,4a69b83045d3195d5b9a9b053ad840ddb2998b4e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,45ebb934ea50b436ce49b2f159f090dab0d7fa28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,4d587cd8a72155089a627130bbd4716ec0856e21)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.177,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.144,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.95,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.38,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.3,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T02:45:02.819701+00:00", "updated": "2026-07-30T22:15:13.605527+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}