CVE-2026-63828

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in AppArmor where the sendmsg() and sendto() functions, when used with the MSG FASTOPEN flag, combine the actions of connect(2) and write(2) to open a connection during the SYN phase. Because the apparmor socket sendmsg() function only verifies the AA MAY SEND permission, a confined task can establish an outbound TCP or MPTCP connection even if the profile explicitly denies the connect permission, thereby bypassing connect mediation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.