CVE-2026-53367: Linux Kernel Information Disclosure Flaw

CVE-2026-53367 Overview

CVE-2026-53367 is a Linux kernel vulnerability in the SELinux subsystem. The per-task Access Vector Cache (avdcache) incorrectly saved and reused the audited vector computed by avc_audit_required() instead of recomputing it against the currently requested permissions. The cache also failed to distinguish between denied and allowed access decisions. As a result, some permission checks were silently skipped by the audit subsystem, undermining the integrity of SELinux audit records.

Critical Impact
Missed audit events can hide unauthorized access attempts from monitoring pipelines. For example, directory write checks issued after a previously cached directory search check were not audited.

Affected Products

Linux kernel builds containing the per-task avdcache in the SELinux subsystem
Distributions shipping kernels prior to the referenced upstream commits
Systems relying on SELinux audit logs for compliance or intrusion detection

Discovery Timeline

2026-07-19 - CVE-2026-53367 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-53367

Vulnerability Analysis

SELinux enforces mandatory access control by consulting the Access Vector Cache (AVC) for permission decisions. To reduce policy lookup overhead, the kernel maintains a per-task avdcache that stores the results of recent access vector decisions. The audit path relies on avc_audit_required() to determine which permissions should generate an audit record for a given decision.

The flaw stems from the cache storing the audited vector produced by a prior call and reusing that value for subsequent permission checks on the same object. Different callers request different permission bits, and the audit decision must also branch on whether the current access is granted or denied. By reusing a stale audited vector, the kernel bypassed audit emission for permissions that were never evaluated by the original call.

The practical consequence is inconsistent audit coverage. A directory search check cached earlier could suppress audit generation for a subsequent directory write check on the same directory. Security monitoring that depends on complete AVC audit records loses visibility into the affected operations.

Root Cause

The root cause is a caching logic error in the SELinux audit path. The per-task avdcache conflated the audited vector across distinct permission requests and did not encode the denied-versus-allowed distinction required by avc_audit_required().

Attack Vector

Exploitation is not required for security impact. Any local workload that triggers cached SELinux permission checks can experience missing audit records. An attacker aware of the caching behavior could sequence operations to reduce the likelihood of audit emission for policy-violating actions. The published NVD entry lists no CVSS vector, and the EPSS score is 0.155%.

No verified proof-of-concept code is available. The upstream fix modifies the avdcache handling in the SELinux AVC to recompute the audited vector per request and to branch on the allowed and denied cases separately. See the kernel commits bce6a32, e3e722ea, and f92d5425 for the applied changes.

Detection Methods for CVE-2026-53367

Indicators of Compromise

Gaps in expected type=AVC records in /var/log/audit/audit.log for operations that policy would normally audit
Directory write or modification activity on sensitive paths without a corresponding SELinux audit entry
Discrepancies between application-level file operations and kernel audit records for the same task

Detection Strategies

Compare kernel version output from uname -r against distribution advisories referencing the upstream commits
Run controlled SELinux policy tests that exercise sequential permission checks on the same object and confirm audit emission for each
Correlate process syscall telemetry with SELinux audit events to identify missing decisions

Monitoring Recommendations

Forward auditd output to a centralized log store and alert on statistically anomalous drops in AVC event volume
Track kernel package versions across the fleet and flag hosts running vulnerable builds
Baseline expected audit event rates per host role so silent regressions are visible

How to Mitigate CVE-2026-53367

Immediate Actions Required

Update the Linux kernel to a version containing commits bce6a32, e3e722ea, or f92d5425 as backported by your distribution
Reboot affected hosts after installing the updated kernel package to activate the fix
Review recent SELinux audit logs for gaps that align with the vulnerable code path

Patch Information

The fix is applied upstream in the SELinux AVC code. Reference the mainline commit f92d5425 and the stable backports bce6a32 and e3e722ea. Apply the kernel update supplied by your distribution vendor.

Workarounds

No supported workaround restores complete audit coverage without the patch
Increase syscall-level auditing through auditctl rules to compensate for missed AVC events on critical paths
Restrict local access on hosts running vulnerable kernels until the update is deployed

bash

# Verify running kernel and check for the patched commit in the distribution changelog
uname -r
rpm -q --changelog kernel | grep -iE 'avdcache|selinux avc audit' | head
# On Debian/Ubuntu systems
dpkg -s linux-image-$(uname -r) | grep -i version