Executive brief
A bug in the Linux kernel's auditing system causes incorrect data to be recorded when process capabilities are changed. This flaw means that security logs may show incorrect information about a process's permissions, potentially allowing an attacker to hide their tracks while preparing to gain higher privileges on a system. This primarily impacts organizations that rely on audit logs for compliance, forensic investigations, and monitoring for suspicious activity.
Technical details
A copy-paste error in the __audit_log_capset() function in kernel/auditsc.c causes the 'cap_effective' value to be recorded in the 'cap_inheritable' field of CAPSET audit records. This vulnerability results in the silent corruption of audit data, specifically masking changes to process inheritable capabilities (cap_pi). An attacker with local access could exploit this to modify inheritable capabilities as a precursor to privilege escalation via exec() without the change being accurately reflected in the audit trail. The issue has been present since 2008 and has been patched in multiple stable branches of the Linux kernel.
Affected products
- Linux Linux Kernel 2.6.29 to 6.14
Timeline
- 2026-05-12: other: Patch authored
- 2026-06-26: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0a065c51a225854768b772a0b733a44d77162582
- https://git.kernel.org/stable/c/151ee470edc3d7ed29fe72df678f8357d2ad8ced
- https://git.kernel.org/stable/c/75bd76c9eb2de9afeca03dc5152ebca5fb8fc816
- https://git.kernel.org/stable/c/95de7bb4bf535a9288549d401ebde83cdcbf2792
- https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e
- https://git.kernel.org/stable/c/e35f3550c5b4fab33103c18654c293cee9850b0a
- https://git.kernel.org/stable/c/e4a640475e43f406fdfd56d370b1f34b0cbbc18d