PT-2026-52926 · Undefined · Undefined

Published 2026-06-26 · Updated 2026-06-26 · CVE-2026-53287

NVD

In the Linux kernel, the following vulnerability has been resolved:

audit: fix incorrect inheritable capability in CAPSET records

audit log capset() records the effective capability set into the inheritable field due to a copy-paste error. Every CAPSET audit record therefore reports cap pi (process inheritable) with the value of cap effective instead of cap inheritable.

This silently corrupts audit data used for compliance and forensic analysis: an attacker who modifies inheritable capabilities to prepare for a privilege-escalating exec would have the change masked in the audit trail.

The bug has been present since the original introduction of CAPSET audit records in 2008.

Related Identifiers

CVE-2026-53287

Affected Products

Undefined

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53287 · Security Note
• https://git.kernel.org/stable/c/febb4bf373ac565d3fb8d1f429827bdd983be496 · Note
• https://git.kernel.org/stable/c/75bd76c9eb2de9afeca03dc5152ebca5fb8fc816 · Note
• https://git.kernel.org/stable/c/95de7bb4bf535a9288549d401ebde83cdcbf2792 · Note
• https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e · Note
• https://git.kernel.org/stable/c/e4a640475e43f406fdfd56d370b1f34b0cbbc18d · Note
• https://git.kernel.org/stable/c/0a065c51a225854768b772a0b733a44d77162582 · Note
• https://git.kernel.org/stable/c/151ee470edc3d7ed29fe72df678f8357d2ad8ced · Note
• https://git.kernel.org/stable/c/e35f3550c5b4fab33103c18654c293cee9850b0a · Note