Look up another CVE · open CVE-2026-63828 in the interactive tracker
CVE-2026-63828
apparmor: mediate the implicit connect of TCP fast open sendmsg
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem security/apparmor. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-63828 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.177-1 | Update the kernel and reboot. Fixed in 6.1.177-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.95-1 | Update the kernel and reboot. Fixed in 6.12.95-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() only checks AA_MAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP connection that connect(2) would have refused, bypassing connect mediation. Mediate the implicit connect when MSG_FASTOPEN is set and a destination is supplied. Add it to apparmor_socket_sendmsg() (not the shared aa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm() directly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not cover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
security/apparmor/lsm.c
- What this is
- APPARMOR SECURITY MODULEMAINTAINERS section matched on security/apparmor/ · apparmor@lists.ubuntu.com · Supported
Check it on the machine
grep -w CONFIG_SECURITY_APPARMOR /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_SECURITY_APPARMOR
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 8.4 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Nsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- security/apparmor
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.6 | 5.10.261 | a16714e7cf2b |
| 3.6 | 5.15.212 | 20383429b569 |
| 3.6 | 6.1.177 | 7f57428ce008 |
| 3.6 | 6.6.144 | faea60deaa05 |
| 3.6 | 6.12.95 | 07b71c342382 |
| 3.6 | 6.18.38 | 4a69b83045d3 |
| 3.6 | 7.1.3 | 45ebb934ea50 |
| 3.6 | 7.2 | 4d587cd8a721 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4717-1 | 2026-08-05 | bullseye 5.10.262-1 | tracker |
| DLA-4700-1 | 2026-07-26 | bullseye 6.1.177-1~deb11u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires a confined local process to invoke sendmsg(2)/sendto(2) with MSG_FASTOPEN; the vulnerable AppArmor LSM hook runs on the syscall path before TCP fast-open performs its implicit connect.
- AC:LAttack complexity, low
- Any confined task that already has send permission can reliably trigger the bypass with a single sendmsg/sendto call using MSG_FASTOPEN and a destination address, with no race or special victim state required beyond TCP Fast Open client support.
- PR:LPrivileges required, low
- The attacker must be an unprivileged process confined by an AppArmor profile that grants network send but denies connect (e.g., hardened Snap/sandboxed service profiles on Ubuntu); no real root or capabilities beyond normal confined-user execution are needed.
- UI:NUser interaction, none
- No victim interaction is required; the confined attacker process directly issues the bypassing syscall without needing another user or administrator to perform any action.
- S:CScope, changed
- Successful exploitation crosses the AppArmor confinement boundary, allowing a sandboxed task to establish outbound TCP/MPTCP connections that connect(2) mediation would have blocked, escaping the intended network policy scope.
- C:HConfidentiality impact, high
- Bypassing connect mediation lets a confined process open TCP/MPTCP sessions to destinations policy forbids and read arbitrary response data from those services (internal APIs, metadata endpoints, C2 servers), constituting unauthorized information disclosure.
- I:HIntegrity impact, high
- The bypass enables unauthorized outbound connection establishment and transmission of arbitrary application data (including SYN-cookie data) to hosts explicitly denied by the AppArmor connect rule, violating integrity of the confinement policy.
- A:NAvailability impact, none
- This is a pure LSM policy-bypass flaw with no kernel memory corruption, panic, oops, hang, or resource exhaustion; exploitation does not impact system availability.