TCP Fast Open Vulnerability in Linux Kernel Affecting AppArmor

CVE-2026-63828

What is CVE-2026-63828?

In the Linux kernel, a vulnerability exists within AppArmor that impacts the mediation of implicit connections when TCP Fast Open is enabled. The current implementation allows confined tasks to establish outbound TCP/MPTCP connections that would typically be blocked by the connect mediation. This flaw occurs specifically within the sendmsg()/sendto() functions when used with MSG_FASTOPEN, resulting in potential unauthorized connectivity. The response involves enhancing the AppArmor socket handling to ensure proper permission checks, preventing any circumvention of established security policies.

References