CVE-2026-63828
Received Received - Intake

Implicit TCP Fast Open Connect Bypass in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() only checks AA_MAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP connection that connect(2) would have refused, bypassing connect mediation. Mediate the implicit connect when MSG_FASTOPEN is set and a destination is supplied. Add it to apparmor_socket_sendmsg() (not the shared aa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm() directly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not cover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63828
EUVD
EUVD-2026-45494

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apparmor apparmor *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves AppArmor's mediation of TCP Fast Open connections. The issue is that AppArmor's sendmsg() function only checks for permission to send data (AA_MAY_SEND) but does not verify connect permissions. This allows a confined process to bypass connect mediation and open outbound TCP connections using MSG_FASTOPEN, even if the profile explicitly denies connect rights.

Detection Guidance

This vulnerability affects the AppArmor Linux security module and involves TCP Fast Open sendmsg operations bypassing connect mediation. Detection requires checking AppArmor profiles and kernel behavior. No direct network commands detect this, but you can inspect AppArmor logs and profiles for unusual socket operations. Check if MSG_FASTOPEN is used in sendmsg calls while connect is denied in profiles.

Impact Analysis

This vulnerability could allow a restricted process to establish unauthorized network connections despite being confined by an AppArmor profile. This might lead to data exfiltration, unauthorized access to remote systems, or bypassing security controls that rely on AppArmor mediation.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized data transfers or network connections, violating principles of least privilege and access control required by standards like GDPR and HIPAA. It undermines security controls designed to protect sensitive data.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the AppArmor fix for TCP Fast Open. Review and update AppArmor profiles to ensure they properly mediate MSG_FASTOPEN operations. Disable TCP Fast Open if not required by setting tcp_fastopen to 0 in sysctl.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63828. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart