CVE-2026-53287

A flaw was found in the Linux kernel. When logging changes to process capabilities (fine-grained system privileges), the kernel audit subsystem incorrectly records effective permissions instead of inheritable permissions. A local user can exploit this behavior during privilege escalation attempts to disguise unauthorized permission changes. Consequently, this flaw leads to corrupted audit logs, hindering forensic investigations and compliance monitoring.

Red Hat Product Security rates this vulnerability as having a Moderate impact because it undermines audit record integrity without directly permitting privilege escalation or remote exploitation. In systems running the kernel audit subsystem, capability assignment events are recorded with effective permissions in place of inheritable values. This flaw hinders forensic investigations and security monitoring by masking modifications to process inheritable capabilities during privilege-transitioning executions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.