{"id":"CVE-2026-53287","title":"audit: fix incorrect inheritable capability in CAPSET records","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix incorrect inheritable capability in CAPSET records\n\n__audit_log_capset() records the effective capability set into the\ninheritable field due to a copy-paste …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e68b75a027bb94066576139ee33676264f867b87 < 75bd76c9eb2de9afeca03dc5152ebca5fb8fc816","Linux >= e68b75a027bb94066576139ee33676264f867b87 < febb4bf373ac565d3fb8d1f429827bdd983be496","Linux >= e68b75a027bb94066576139ee33676264f867b87 < 95de7bb4bf535a9288549d401ebde83cdcbf2792","Linux >= e68b75a027bb94066576139ee33676264f867b87 < 151ee470edc3d7ed29fe72df678f8357d2ad8ced","Linux >= e68b75a027bb94066576139ee33676264f867b87 < 0a065c51a225854768b772a0b733a44d77162582","Linux >= e68b75a027bb94066576139ee33676264f867b87 < e35f3550c5b4fab33103c18654c293cee9850b0a","Linux >= e68b75a027bb94066576139ee33676264f867b87 < d782e4d200cd9036ef353eeb29525bfbfd13a14e","Linux >= e68b75a027bb94066576139ee33676264f867b87 < e4a640475e43f406fdfd56d370b1f34b0cbbc18d","Linux 2.6.29"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:25:22.858560Z"},"published":"2026-06-26","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:18.101Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53287","references":[{"url":"https://git.kernel.org/stable/c/75bd76c9eb2de9afeca03dc5152ebca5fb8fc816"},{"url":"https://git.kernel.org/stable/c/febb4bf373ac565d3fb8d1f429827bdd983be496"},{"url":"https://git.kernel.org/stable/c/95de7bb4bf535a9288549d401ebde83cdcbf2792"},{"url":"https://git.kernel.org/stable/c/151ee470edc3d7ed29fe72df678f8357d2ad8ced"},{"url":"https://git.kernel.org/stable/c/0a065c51a225854768b772a0b733a44d77162582"},{"url":"https://git.kernel.org/stable/c/e35f3550c5b4fab33103c18654c293cee9850b0a"},{"url":"https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e"},{"url":"https://git.kernel.org/stable/c/e4a640475e43f406fdfd56d370b1f34b0cbbc18d"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.02049,"ingestedAt":"2026-11-06T16:57:43.251Z","slug":"CVE-2026-53287","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix incorrect inheritable capability in CAPSET records\n\n__audit_log_capset() records the effective capability set into the\ninheritable field due to a copy-paste error. Every CAPSET audit\nrecord therefore reports cap_pi (process inheritable) with the value\nof cap_effective instead of cap_inheritable.\n\nThis silently corrupts audit data used for compliance and forensic\nanalysis: an attacker who modifies inheritable capabilities to\nprepare for a privilege-escalating exec would have the change masked\nin the audit trail.\n\nThe bug has been present since the original introduction of CAPSET\naudit records in 2008.\n\n## Affected\n\n- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < 75bd76c9eb2de9afeca03dc5152ebca5fb8fc816`\n- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < febb4bf373ac565d3fb8d1f429827bdd983be496`\n- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < 95de7bb4bf535a9288549d401ebde83cdcbf2792`\n- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < 151ee470edc3d7ed29fe72df678f8357d2ad8ced`\n- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < 0a065c51a225854768b772a0b733a44d77162582`\n- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < e35f3550c5b4fab33103c18654c293cee9850b0a`\n- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < d782e4d200cd9036ef353eeb29525bfbfd13a14e`\n- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < e4a640475e43f406fdfd56d370b1f34b0cbbc18d`\n- `Linux 2.6.29`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}