Riskcovery

CVE-2026-53236

tcp: restrict SO_ATTACH_FILTER to priv users

State
Published
Severity
Not scored
Published
Jun 25, 2026
Updated
Oct 15, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: restrict SO_ATTACH_FILTER to priv users

This patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets to users with CAP_NET_ADMIN capability.

This blocks potential side-channel attack where an unprivileged application attaches a filter to leak TCP sequence/acknowledgment numbers.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3747de241a66ef2c7032d2cc2b826a47c5fa0f6aAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ecfe9171b26ae3eed0cd8bab7a943e9e2c9e51baAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 82b3e7ce10c53fc12aab8904745603efc74f8c07Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ede69b8f6670600e534591664584f810d7c385f9Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c68517a3e18e20997808821c5559d0cba4d776c1Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5d39580f68e6ddeedd15e587282207489dfb3da2Affected
LinuxLinux
  • 2.6.12Affected
  • before 2.6.12Not affected
  • 6.1.176 through 6.1.*Not affected
  • 6.6.143 through 6.6.*Not affected
  • 6.12.94 through 6.12.*Not affected
  • 6.18.36 through 6.18.*Not affected
  • 7.0.13 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.