CVE-2026-72243

A flaw was found in the Linux kernel's Security-Enhanced Linux (SELinux) module. When using TCP Fast Open, SELinux failed to properly check connect-related permissions. This oversight could allow a local attacker to bypass SELinux network access controls, potentially enabling unauthorized network connections that should have been restricted by security policies.

This vulnerability is rated as an Important severity flaw because it allows an unprivileged local user or confined domain to subvert mandatory access controls and initiate restricted outbound network communications. On Red Hat Enterprise Linux systems running SELinux in enforcing mode, the lack of socket connection authorization checks during TCP Fast Open operations undermines isolation boundaries intended to confine unprivileged processes. While exploitation necessitates local code execution on the host, the ability to defeat security policy enforcement without elevated privileges warrants the Important classification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, TCP Fast Open (TFO) can be disabled if not required by applications. Disabling TFO prevents the vulnerable code path from being exercised, thereby eliminating the SELinux permission bypass.

To disable TCP Fast Open:

1. Check the current setting: sysctl net.ipv4.tcp_fastopen
2. To disable it temporarily: sudo sysctl -w net.ipv4.tcp_fastopen=0
3. To make the change persistent across reboots, add or modify the following line in /etc/sysctl.conf: net.ipv4.tcp_fastopen = 0
4. Apply the persistent changes: sudo sysctl -p

Disabling TCP Fast Open may impact the performance of applications that utilize this feature for faster connection establishment.