CVE-2026-63828

A flaw was found in the Linux kernel's AppArmor security module. A local user, confined by an AppArmor profile that grants send permission but denies connect permission, can bypass the intended security mediation. This bypass occurs when using sendmsg() or sendto() with the MSG_FASTOPEN flag, allowing the confined task to establish outbound TCP/MPTCP connections that should have been blocked. This could lead to unauthorized network activity from a supposedly restricted application.