Inheritable Capability Corruption in Linux Kernel Audit Records

CVE-2026-53287

What is CVE-2026-53287?

A vulnerability in the Linux kernel's audit logging system has been identified, where the process inheritable capability is incorrectly recorded due to a copy-paste error. This flaw results in audit records reporting the effective capability set instead of the intended inheritable set. Consequently, this can lead to the manipulation of the audit trail, allowing potential attackers to mask unauthorized changes to inheritable capabilities, thereby facilitating privilege escalation efforts without detection. This bug has persisted since the inception of CAPSET audit records in 2008, compromising the integrity of compliance and forensic analyses reliant on accurate audit data.

References