CVE-2026-53236: Linux Kernel Privilege Escalation Flaw

CVE-2026-53236 Overview

CVE-2026-53236 affects the Linux kernel's TCP socket implementation. The vulnerability allows unprivileged applications to attach classic Berkeley Packet Filter (cBPF) programs to TCP sockets via the SO_ATTACH_FILTER socket option. An attacker can use this filter to leak TCP sequence and acknowledgment numbers through a side-channel attack. The upstream fix restricts SO_ATTACH_FILTER on TCP sockets to processes holding the CAP_NET_ADMIN capability. This information leak can facilitate TCP connection hijacking and injection attacks against established sessions on affected systems.

Critical Impact
Unprivileged local processes can leak TCP sequence and acknowledgment numbers via cBPF filters, enabling side-channel attacks against active TCP connections.

Affected Products

Linux kernel (multiple stable branches, per upstream commits)
Distributions shipping affected kernel versions
Systems exposing TCP socket creation to unprivileged users

Discovery Timeline

2026-06-25 - CVE-2026-53236 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53236

Vulnerability Analysis

The vulnerability resides in the Linux kernel TCP socket layer, which previously permitted any user to attach a cBPF filter program to a TCP socket using the SO_ATTACH_FILTER socket option. cBPF filters execute against incoming packets and can return values derived from packet contents, including header fields. An unprivileged attacker can craft a filter that observes TCP sequence and acknowledgment numbers through filter return values or accept/drop side effects. The issue is classified as a Side Channel Attack and Information Exposure flaw in kernel networking code.

Root Cause

The root cause is missing capability enforcement on SO_ATTACH_FILTER for TCP sockets. The kernel allowed attachment without verifying privileges, exposing sensitive TCP state to user-controlled filter logic. The fix gates this operation behind the CAP_NET_ADMIN capability check, aligning TCP filter attachment with other privileged network operations.

Attack Vector

An unprivileged local process opens or accesses a TCP socket and calls setsockopt with SO_ATTACH_FILTER to install a cBPF program. The filter inspects header fields containing the TCP sequence and acknowledgment numbers. By observing filter behavior, the attacker reconstructs these values. With leaked sequence numbers, an adversary on the same host or network path can craft spoofed segments to inject data or reset established connections. Full technical details are available in the Kernel Git Commit 3747de2 and related stable backports.

Detection Methods for CVE-2026-53236

Indicators of Compromise

Unexpected setsockopt calls with SO_ATTACH_FILTER originating from unprivileged user processes against TCP sockets.
Processes without CAP_NET_ADMIN invoking BPF-related syscalls in proximity to active TCP sessions.
Anomalous TCP resets or out-of-order injections targeting long-lived TCP sessions on the host.

Detection Strategies

Audit setsockopt syscalls with option name SO_ATTACH_FILTER (optname 26) using auditd rules or eBPF tracing.
Correlate cBPF filter attachment events with the effective UID and capability set of the calling process.
Hunt for unprivileged processes loading classic BPF programs and accessing TCP sockets in close succession.

Monitoring Recommendations

Enable kernel auditing of socket option syscalls and capture process lineage for forensic analysis.
Track kernel version inventory across endpoints to identify hosts still running pre-patch builds.
Monitor for unexpected TCP session resets or injections that may indicate active exploitation attempts.

How to Mitigate CVE-2026-53236

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits to all affected systems.
Inventory Linux hosts and prioritize patching multi-tenant or shared-user systems where unprivileged exploitation is most feasible.
Restrict local shell access on critical TCP-facing servers until patched kernels are deployed.

Patch Information

The upstream fix adds a CAP_NET_ADMIN check before allowing SO_ATTACH_FILTER on TCP sockets. Backports are available across multiple stable branches via the following commits: 3747de2, 5d39580, 82b3e7c, c68517a, ecfe917, and ede69b8.

Workarounds

Use seccomp filters to block setsockopt with SO_ATTACH_FILTER for untrusted workloads where feasible.
Restrict unprivileged BPF via the kernel.unprivileged_bpf_disabled sysctl to limit broader BPF attack surface.
Isolate untrusted users into containers or namespaces with strict capability and syscall policies.

bash

# Disable unprivileged BPF as a defense-in-depth measure
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/90-bpf-hardening.conf