CVE-2026-53287 Details
Description
In the Linux kernel, the following vulnerability has been resolved: audit: fix incorrect inheritable capability in CAPSET records __audit_log_capset() records the effective capability set into the inheritable field due to a copy-paste error. Every CAPSET audit record therefore reports cap_pi (process inheritable) with the value of cap_effective instead of cap_inheritable. This silently corrupts audit data used for compliance and forensic analysis: an attacker who modifies inheritable capabilities to prepare for a privilege-escalating exec would have the change masked in the audit trail. The bug has been present since the original introduction of CAPSET audit records in 2008.
A vulnerability in the Linux kernel's auditing system has been identified, specifically within the CAPSET audit records. This issue arises from a copy-paste error that causes the effective capability set to be incorrectly recorded in the inheritable capabilities field. As a result, every CAPSET audit record misrepresents the process inheritable capabilities by substituting them with the effective capabilities. This distortion of audit data has significant implications for compliance and forensic analysis, as it can obscure an attacker's modifications of inheritable capabilities intended for privilege escalation. The flaw has existed since CAPSET audit records were first introduced in 2008.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0a065c51a225854768b772a0b733a44d77162582 | kernel.org | Patch |
| https://git.kernel.org/stable/c/151ee470edc3d7ed29fe72df678f8357d2ad8ced | kernel.org | Patch |
| https://git.kernel.org/stable/c/75bd76c9eb2de9afeca03dc5152ebca5fb8fc816 | kernel.org | Patch |
| https://git.kernel.org/stable/c/95de7bb4bf535a9288549d401ebde83cdcbf2792 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e | kernel.org | Patch |
| https://git.kernel.org/stable/c/e35f3550c5b4fab33103c18654c293cee9850b0a | kernel.org | Patch |
| https://git.kernel.org/stable/c/e4a640475e43f406fdfd56d370b1f34b0cbbc18d | kernel.org | Patch |
| https://git.kernel.org/stable/c/febb4bf373ac565d3fb8d1f429827bdd983be496 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.29, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.141 >= 6.7, < 6.12.91 >= 6.13, < 6.18.33 >= 6.19, < 7.0.10 7.1 rc1 7.1 rc2 7.1 rc3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | New CVE Received | kernel.org |