CVE-2026-53287
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-06-26
Modified: 2026-11-06
First seen: 2026-11-06
Status: active
Attack Surface
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: audit: fix incorrect inheritable capability in CAPSET records __audit_log_capset() records the effective capability set into the inheritable field due to a copy-paste error. Every CAPSET audit record therefore reports cap_pi (process inheritable) with the value of cap_effective instead of cap_inheritable. This silently corrupts audit data used for compliance and forensic analysis: an attacker who modifies inheritable capabilities to prepare for a privilege-escalating exec would have the change masked in the audit trail. The bug has been present since the original introduction of CAPSET audit records in 2008.
Affected Software (13)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | e68b75a027bb94066576139ee33676264f867b87 < 75bd76c9eb2de9afeca03dc5152ebca5fb8fc816 |
| Linux | Linux | e68b75a027bb94066576139ee33676264f867b87 < febb4bf373ac565d3fb8d1f429827bdd983be496 |
| Linux | Linux | e68b75a027bb94066576139ee33676264f867b87 < 95de7bb4bf535a9288549d401ebde83cdcbf2792 |
| Linux | Linux | e68b75a027bb94066576139ee33676264f867b87 < 151ee470edc3d7ed29fe72df678f8357d2ad8ced |
| Linux | Linux | e68b75a027bb94066576139ee33676264f867b87 < 0a065c51a225854768b772a0b733a44d77162582 |
| Linux | Linux | e68b75a027bb94066576139ee33676264f867b87 < e35f3550c5b4fab33103c18654c293cee9850b0a |
| Linux | Linux | e68b75a027bb94066576139ee33676264f867b87 < d782e4d200cd9036ef353eeb29525bfbfd13a14e |
| Linux | Linux | e68b75a027bb94066576139ee33676264f867b87 < e4a640475e43f406fdfd56d370b1f34b0cbbc18d |
| Linux | Linux | 2.6.29 |
| linux | linux_kernel | 2.6.29 – 5.10.258 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |