PT-2026-61144 · Linux · Linux

CVE-2026-63828 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

In the Linux kernel, the following vulnerability has been resolved:

apparmor: mediate the implicit connect of TCP fast open sendmsg

sendmsg()/sendto() with MSG FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor socket sendmsg() only checks AA MAY SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP connection that connect(2) would have refused, bypassing connect mediation.

Mediate the implicit connect when MSG FASTOPEN is set and a destination is supplied. Add it to apparmor socket sendmsg() (not the shared aa sock msg perm() helper, which recvmsg also uses) and call aa sk perm() directly, mirroring the selinux and tomoyo fixes. sk is tcp() does not cover MPTCP fast open, so the SOCK STREAM/IPPROTO MPTCP arm is explicit.

Correção

Identificadores relacionados

CVE-2026-63828

Produtos afetados

Linux

Referências · 7

• https://git.kernel.org/stable/c/7f57428ce00891d26b0f087ef754a4d820ec83aa · Nota
• https://git.kernel.org/stable/c/07b71c342382b854ab8030b244aeab6a7228ad7d · Nota
• https://git.kernel.org/stable/c/faea60deaa05c76f0772650f42eafde12bd39d93 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63828 · Nota de Segurança
• https://git.kernel.org/stable/c/4a69b83045d3195d5b9a9b053ad840ddb2998b4e · Nota
• https://git.kernel.org/stable/c/4d587cd8a72155089a627130bbd4716ec0856e21 · Nota
• https://git.kernel.org/stable/c/45ebb934ea50b436ce49b2f159f090dab0d7fa28 · Nota