Executive brief
A vulnerability in the Linux kernel could allow a local user to monitor network traffic details that should be private. By attaching a specific type of filter to network connections, an attacker could leak sensitive technical data like sequence numbers, which are used to manage data flow. This information could potentially be used to facilitate more advanced network-based attacks.
Technical details
A side-channel vulnerability existed in the Linux kernel's TCP implementation due to insufficient permission checks when using the SO_ATTACH_FILTER socket option. Specifically, unprivileged users could attach classic Berkeley Packet Filter (cBPF) programs to TCP sockets, which could be leveraged to leak sensitive protocol metadata such as TCP sequence and acknowledgment numbers. The fix introduces a requirement for the CAP_NET_ADMIN capability when attempting to use SO_ATTACH_FILTER on TCP sockets. This issue affects versions as far back as 2.6.12 and has been patched in various stable branches including 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13.
Affected products
- Linux Linux Kernel 2.6.12 to 7.0.12
Timeline
- 2026-06-05: other: Initial patch authored by Eric Dumazet
- 2026-06-25: disclosed: CVE published to NVD dataset
References
- https://git.kernel.org/stable/c/3747de241a66ef2c7032d2cc2b826a47c5fa0f6a
- https://git.kernel.org/stable/c/5d39580f68e6ddeedd15e587282207489dfb3da2
- https://git.kernel.org/stable/c/82b3e7ce10c53fc12aab8904745603efc74f8c07
- https://git.kernel.org/stable/c/c68517a3e18e20997808821c5559d0cba4d776c1
- https://git.kernel.org/stable/c/ecfe9171b26ae3eed0cd8bab7a943e9e2c9e51ba
- https://git.kernel.org/stable/c/ede69b8f6670600e534591664584f810d7c385f9