{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63828", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.014Z", "datePublished": "2026-07-19T12:02:22.644Z", "dateUpdated": "2026-07-20T13:40:31.639Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-20T13:40:31.639Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: mediate the implicit connect of TCP fast open sendmsg\n\nsendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and\nwrite(2): it opens the connection in the SYN. apparmor_socket_sendmsg()\nonly checks AA_MAY_SEND, so a profile that grants send but denies connect\nlets a confined task open an outbound TCP/MPTCP connection that connect(2)\nwould have refused, bypassing connect mediation.\n\nMediate the implicit connect when MSG_FASTOPEN is set and a destination\nis supplied. Add it to apparmor_socket_sendmsg() (not the shared\naa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm()\ndirectly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not\ncover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 8.4, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/apparmor/lsm.c"], "versions": [{"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "7f57428ce00891d26b0f087ef754a4d820ec83aa", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "faea60deaa05c76f0772650f42eafde12bd39d93", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "07b71c342382b854ab8030b244aeab6a7228ad7d", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "4a69b83045d3195d5b9a9b053ad840ddb2998b4e", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "45ebb934ea50b436ce49b2f159f090dab0d7fa28", "status": "affected", "versionType": "git"}, {"version": "cf60af03ca4e71134206809ea892e49b92a88896", "lessThan": "4d587cd8a72155089a627130bbd4716ec0856e21", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/apparmor/lsm.c"], "versions": [{"version": "3.6", "status": "affected"}, {"version": "0", "lessThan": "3.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.177", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.144", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.1.177"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.6.144"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.18.38"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.1.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7f57428ce00891d26b0f087ef754a4d820ec83aa"}, {"url": "https://git.kernel.org/stable/c/faea60deaa05c76f0772650f42eafde12bd39d93"}, {"url": "https://git.kernel.org/stable/c/07b71c342382b854ab8030b244aeab6a7228ad7d"}, {"url": "https://git.kernel.org/stable/c/4a69b83045d3195d5b9a9b053ad840ddb2998b4e"}, {"url": "https://git.kernel.org/stable/c/45ebb934ea50b436ce49b2f159f090dab0d7fa28"}, {"url": "https://git.kernel.org/stable/c/4d587cd8a72155089a627130bbd4716ec0856e21"}], "title": "apparmor: mediate the implicit connect of TCP fast open sendmsg", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: apparmor: mediate the implicit connect of TCP fast open sendmsg", "id": "2502242", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502242"}, "csaw": false, "cwe": "CWE-1220", "details": ["In the Linux kernel, the following vulnerability has been resolved:\napparmor: mediate the implicit connect of TCP fast open sendmsg\nsendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and\nwrite(2): it opens the connection in the SYN. apparmor_socket_sendmsg()\nonly checks AA_MAY_SEND, so a profile that grants send but denies connect\nlets a confined task open an outbound TCP/MPTCP connection that connect(2)\nwould have refused, bypassing connect mediation.\nMediate the implicit connect when MSG_FASTOPEN is set and a destination\nis supplied. Add it to apparmor_socket_sendmsg() (not the shared\naa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm()\ndirectly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not\ncover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit.", "A flaw was found in the Linux kernel's AppArmor security module. A local user, confined by an AppArmor profile that grants send permission but denies connect permission, can bypass the intended security mediation. This bypass occurs when using sendmsg() or sendto() with the MSG_FASTOPEN flag, allowing the confined task to establish outbound TCP/MPTCP connections that should have been blocked. This could lead to unauthorized network activity from a supposedly restricted application."], "name": "CVE-2026-63828", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63828\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63828\nhttps://lore.kernel.org/linux-cve-announce/2026071907-CVE-2026-63828-c436@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,7f57428ce00891d26b0f087ef754a4d820ec83aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,faea60deaa05c76f0772650f42eafde12bd39d93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,07b71c342382b854ab8030b244aeab6a7228ad7d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,4a69b83045d3195d5b9a9b053ad840ddb2998b4e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,45ebb934ea50b436ce49b2f159f090dab0d7fa28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf60af03ca4e71134206809ea892e49b92a88896,4d587cd8a72155089a627130bbd4716ec0856e21)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.177,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.144,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.95,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.38,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.3,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T02:45:02.819701+00:00", "updated": "2026-07-21T02:45:02.819738+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}