CVE-2026-53287

MediumCVSS 5.5/10Last modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

audit: fix incorrect inheritable capability in CAPSET records

__audit_log_capset() records the effective capability set into the inheritable field due to a copy-paste error. Every CAPSET audit record therefore reports cap_pi (process inheritable) with the value of cap_effective instead of cap_inheritable.

This silently corrupts audit data used for compliance and forensic analysis: an attacker who modifies inheritable capabilities to prepare for a privilege-escalating exec would have the change masked in the audit trail.

The bug has been present since the original introduction of CAPSET audit records in 2008.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= e68b75a027bb94066576139ee33676264f867b87, < 75bd76c9eb2de9afeca03dc5152ebca5fb8fc816; >= e68b75a027bb94066576139ee33676264f867b87, < febb4bf373ac565d3fb8d1f429827bdd983be496; >= e68b75a027bb94066576139ee33676264f867b87, < 95de7bb4bf535a9288549d401ebde83cdcbf2792; >= e68b75a027bb94066576139ee33676264f867b87, < 151ee470edc3d7ed29fe72df678f8357d2ad8ced; >= e68b75a027bb94066576139ee33676264f867b87, < 0a065c51a225854768b772a0b733a44d77162582; >= e68b75a027bb94066576139ee33676264f867b87, < e35f3550c5b4fab33103c18654c293cee9850b0a; >= e68b75a027bb94066576139ee33676264f867b87, < d782e4d200cd9036ef353eeb29525bfbfd13a14e; >= e68b75a027bb94066576139ee33676264f867b87, < e4a640475e43f406fdfd56d370b1f34b0cbbc18d
LinuxLinux2.6.29

References

Timeline

Published
Jun 26, 2026
Last modified
Nov 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-532885.5In the Linux kernel, the following vulnerability has been resolved: arm64: Reserve an extra page for early kernel mapping The final part oCVE-2026-532895.5In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_reset_all_vfs() ice_reset_allCVE-2026-53296.5Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on CVE-2026-532907.8In the Linux kernel, the following vulnerability has been resolved: drm/xe/eustall: Fix drm_dev_put called before stream disable in close CVE-2026-532915.5In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/conexant: Fix missing error check for jack detection In cx_pCVE-2026-532925.5In the Linux kernel, the following vulnerability has been resolved: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind syCVE-2026-532935.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG There were multiple issues inCVE-2026-532947.8In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: don't free the reused channel The RX channel caCVE-2026-532955.5In the Linux kernel, the following vulnerability has been resolved: mailbox: add sanity check for channel array Fail gracefully if there iCVE-2026-532967.8In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: free channels on probe error On probe error, frCVE-2026-532975.5In the Linux kernel, the following vulnerability has been resolved: net: mana: Guard mana_remove against double invocation If PM resume faCVE-2026-532985.5In the Linux kernel, the following vulnerability has been resolved: net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_qu