CVE-2026-53249: Linux Kernel Privilege Escalation Flaw

CVE-2026-53249 Overview

CVE-2026-53249 is a Linux kernel vulnerability in the IPv4 networking stack that allowed unprivileged users to set the Loose Source and Record Route (IPOPT_LSRR) and Strict Source and Record Route (IPOPT_SSRR) IP options on outgoing packets. The upstream fix restricts these options to processes holding the CAP_NET_RAW capability. Without this restriction, local applications could force packets to traverse attacker-controlled intermediate hops, enabling information disclosure attacks such as leaking TCP Initial Sequence Numbers (ISNs).

Critical Impact
Unprivileged local users could manipulate IPv4 source routing options to redirect traffic through attacker-chosen nodes, exposing TCP ISN values and other protocol state that aid spoofing and hijacking attacks.

Affected Products

Linux kernel — IPv4 networking subsystem (net/ipv4)
Distributions shipping affected upstream kernel versions prior to the stable backports
Systems exposing raw socket option interfaces to unprivileged user processes

Discovery Timeline

2026-06-25 - CVE-2026-53249 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53249

Vulnerability Analysis

The vulnerability falls under the Information Exposure category [CWE-200] and stems from missing capability checks when applications set IPv4 source routing options. LSRR and SSRR are legacy IP options defined in RFC 791 that let the sender specify a list of intermediate routers a packet must traverse. RFC 7126 sections 4.3 and 4.4 recommend dropping packets carrying these options because they enable traffic redirection and reconnaissance.

Before the patch, any local process could attach IPOPT_LSRR or IPOPT_SSRR to outbound IPv4 packets through standard socket option interfaces. While many upstream networks filter such packets, intermediate paths may still honor them. An attacker who induces a victim host to send source-routed packets can observe the resulting traffic at a chosen waypoint and extract TCP ISN values, sequence state, and other protocol-level data useful for blind spoofing or session hijacking.

Root Cause

The IPv4 option handling code accepted LSRR and SSRR option settings from any caller without verifying privileges. The fix enforces a CAP_NET_RAW check, aligning these options with the policy already applied to other raw network manipulation primitives. The kernel commits referenced in the advisory add the capability check across stable branches.

Attack Vector

Exploitation requires local access to set socket options on an outbound IPv4 socket. An unprivileged user crafts packets containing source routing options that direct traffic through a network location the attacker monitors. By analyzing returned responses or initial handshake packets, the attacker recovers TCP ISN values and related state. The vulnerability does not provide remote code execution; it is a local information disclosure primitive that strengthens follow-on network attacks.

No public exploit code is associated with this CVE. The technical details are documented in the upstream patch series, including Kernel Git Commit 00e8845 and Kernel Git Commit a4f3fd6.

Detection Methods for CVE-2026-53249

Indicators of Compromise

Outbound IPv4 packets from internal hosts carrying option type 0x83 (LSRR) or 0x89 (SSRR) in the IP options field.
Unexpected setsockopt calls referencing IP_OPTIONS from non-privileged user contexts in audit logs.
Unusual traffic patterns where packets to a destination traverse atypical next-hop addresses inserted via source routing.

Detection Strategies

Capture network telemetry at perimeter and east-west sensors and flag IPv4 packets whose options field length exceeds the standard header, then inspect for LSRR/SSRR option codes.
Enable Linux audit rules on the setsockopt syscall filtering for IP_OPTIONS and correlate with the invoking UID to identify unprivileged callers.
Hunt for processes invoking raw or option-laden socket APIs using EDR process and syscall telemetry.

Monitoring Recommendations

Forward kernel audit and network flow data to a central analytics platform and build identifications for source-routed packets, which should be rare on modern networks.
Alert on TCP sessions where observed ISN entropy or sequence patterns deviate from baselines, suggesting reconnaissance against ISN generation.
Track kernel package versions across the fleet and flag hosts that have not received the patched stable kernels referenced in the upstream commits.

How to Mitigate CVE-2026-53249

Immediate Actions Required

Update Linux kernels to the patched stable releases that include the commits restricting IPOPT_SSRR and IPOPT_LSRR to CAP_NET_RAW holders.
Audit which local user accounts and containers hold CAP_NET_RAW and remove the capability where it is not required.
Configure perimeter routers, firewalls, and host iptables/nftables rules to drop IPv4 packets containing source routing options, as recommended in RFC 7126.

Patch Information

The fix is distributed across multiple stable branches in the upstream Linux kernel. Reference commits include Kernel Git Commit 00e8845, Kernel Git Commit 28f5ad1, Kernel Git Commit 2a87c3e, Kernel Git Commit 4cd6e9e, Kernel Git Commit 89343ff, Kernel Git Commit 8ff85db, Kernel Git Commit a4f3fd6, and Kernel Git Commit d3915a1. Apply the distribution-provided kernel updates that incorporate these commits and reboot affected hosts.

Workarounds

Drop inbound and outbound IPv4 packets containing source routing options at network gateways and host firewalls until the kernel update is deployed.
Restrict CAP_NET_RAW by removing it from container default capability sets and from setuid binaries that do not require raw socket access.
Apply seccomp profiles to high-risk workloads to block setsockopt calls with the IP_OPTIONS level for processes that have no legitimate need.

bash

# Drop IPv4 packets carrying LSRR (option 0x83) or SSRR (option 0x89)
sudo iptables -A INPUT  -m ipv4options --ssrr --lsrr -j DROP
sudo iptables -A OUTPUT -m ipv4options --ssrr --lsrr -j DROP
sudo iptables -A FORWARD -m ipv4options --ssrr --lsrr -j DROP

# Disable source-routed packet acceptance at the kernel level
sudo sysctl -w net.ipv4.conf.all.accept_source_route=0
sudo sysctl -w net.ipv4.conf.default.accept_source_route=0