TCP Fast Open Vulnerability in Linux Kernel Affecting AppArmor
CVE-2026-63828
Key Information:
Badges
What is CVE-2026-63828?
In the Linux kernel, a vulnerability exists within AppArmor that impacts the mediation of implicit connections when TCP Fast Open is enabled. The current implementation allows confined tasks to establish outbound TCP/MPTCP connections that would typically be blocked by the connect mediation. This flaw occurs specifically within the sendmsg()/sendto() functions when used with MSG_FASTOPEN, resulting in potential unauthorized connectivity. The response involves enhancing the AppArmor socket handling to ensure proper permission checks, preventing any circumvention of established security policies.
Affected Version(s)
Linux cf60af03ca4e71134206809ea892e49b92a88896
Linux cf60af03ca4e71134206809ea892e49b92a88896 < 20383429b56974507c465d016e5238b189f7a246
Linux cf60af03ca4e71134206809ea892e49b92a88896 < 7f57428ce00891d26b0f087ef754a4d820ec83aa
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.