CVE-2026-63828 Overview
CVE-2026-63828 is a Linux kernel vulnerability in the AppArmor Linux Security Module (LSM). The flaw exists in how AppArmor mediates TCP Fast Open (TFO) socket operations. When sendmsg() or sendto() is called with the MSG_FASTOPEN flag, the kernel performs an implicit connect() inside the SYN packet. AppArmor's apparmor_socket_sendmsg() only checked AA_MAY_SEND and skipped the connect mediation path. A confined process with a profile permitting send but denying connect could establish outbound TCP or MPTCP connections that connect(2) would have refused.
Critical Impact
A local confined process can bypass AppArmor connect mediation to establish outbound TCP/MPTCP connections, breaking the sandbox network policy.
Affected Products
- Linux kernel builds using the AppArmor LSM with TCP Fast Open enabled
- Distributions shipping AppArmor-confined services (Ubuntu, Debian, SUSE and derivatives)
- Systems supporting MPTCP with AppArmor confinement
Discovery Timeline
- 2026-07-19 - CVE-2026-63828 published to NVD
- 2026-07-24 - Last updated in NVD database
Technical Details for CVE-2026-63828
Vulnerability Analysis
The vulnerability resides in the AppArmor socket mediation logic within the Linux kernel. AppArmor enforces network policy at multiple hook points, including connect, bind, sendmsg, and recvmsg. TCP Fast Open collapses connection establishment and payload transmission into a single system call. When MSG_FASTOPEN is supplied to sendmsg() or sendto() with a destination address, the kernel opens the connection within the SYN packet and delivers data in the same operation.
The pre-patch apparmor_socket_sendmsg() implementation invoked aa_sock_msg_perm() and evaluated only the AA_MAY_SEND permission. It never triggered the connect mediation path. A profile granting send but denying connect therefore permitted outbound sessions that a standard connect(2) would have blocked. The bypass applies to both plain TCP sockets and MPTCP sockets, since sk_is_tcp() alone does not cover the MPTCP fast open case.
Root Cause
The root cause is a missing security check [Broken Access Control]. The sendmsg hook did not account for the implicit connect() semantics introduced by TCP Fast Open. The fix mediates the implicit connect when MSG_FASTOPEN is set and a destination is supplied, calling aa_sk_perm() directly and adding an explicit SOCK_STREAM/IPPROTO_MPTCP arm. The change mirrors equivalent fixes previously applied to the SELinux and TOMOYO LSMs.
Attack Vector
Exploitation requires local access and an existing AppArmor profile that grants send permissions but withholds connect permissions on network sockets. A confined process crafts a sendmsg() or sendto() call with the MSG_FASTOPEN flag and a destination address. The kernel processes the outbound SYN before the connect hook is evaluated, allowing the confined task to reach network destinations the policy intended to deny. The impact is contained to policy enforcement bypass and does not yield code execution.
See the kernel patch commit 07b71c342 for the reference implementation.
Detection Methods for CVE-2026-63828
Indicators of Compromise
- Outbound TCP or MPTCP connections originating from AppArmor-confined processes to destinations disallowed by profile connect rules
- sendmsg() or sendto() syscalls issued with the MSG_FASTOPEN flag from confined tasks
- Absence of AppArmor audit denials for connect operations that precede established network sessions
Detection Strategies
- Audit auditd logs for apparmor="ALLOWED" operation="sendmsg" events immediately followed by SYN activity to unusual destinations
- Correlate confined process network telemetry against expected profile scopes to identify policy drift
- Enable kernel tracepoints on the inet_sendmsg path filtered by MSG_FASTOPEN to observe fast-open socket usage
Monitoring Recommendations
- Log all outbound connections from AppArmor-confined services and compare against the profile's allowed peer set
- Track kernel version and AppArmor patch level across Linux endpoints and servers
- Alert on new outbound destinations from processes running under restrictive AppArmor profiles
How to Mitigate CVE-2026-63828
Immediate Actions Required
- Apply the vendor-provided kernel update that includes the AppArmor TCP Fast Open mediation fix
- Inventory AppArmor profiles that grant send without matching connect permissions and review their exposure
- Restrict TCP Fast Open system-wide where confined workloads do not require it
Patch Information
The fix adds an explicit mediation call in apparmor_socket_sendmsg() when MSG_FASTOPEN is set and a destination is supplied, invoking aa_sk_perm() directly and adding a SOCK_STREAM/IPPROTO_MPTCP branch. Patched commits include 07b71c342, 20383429b, 45ebb934ea, 4a69b83045, 4d587cd8a7, 7f57428ce0, a16714e7cf, and faea60deaa. Apply distribution kernel updates once the maintainer backports land.
Workarounds
- Disable TCP Fast Open by setting net.ipv4.tcp_fastopen to 0 via sysctl until the kernel patch is deployed
- Update AppArmor profiles to remove send permissions where connect is denied, closing the policy gap
- Use network-layer egress filtering to enforce destination restrictions independent of AppArmor mediation
# Disable TCP Fast Open as a temporary mitigation
sysctl -w net.ipv4.tcp_fastopen=0
echo "net.ipv4.tcp_fastopen = 0" >> /etc/sysctl.d/99-cve-2026-63828.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
