IP Options Vulnerability in Linux Kernel

CVE-2026-53249

What is CVE-2026-53249?

The Linux kernel has addressed a significant vulnerability affecting the processing of Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IP options. This issue allows unprivileged applications to manipulate packet routing, potentially exposing TCP Initial Sequence Numbers (ISNs) and other critical protocol information. By restricting these options to users with CAP_NET_RAW capability, the kernel mitigates the risk of packets being rerouted through compromised nodes, aligning with recommendations from RFC 7126. Although many network configurations already filter these options, some paths may still permit them, necessitating this crucial patch.

References