---
id: CVE-2026-53287
title: 'audit: fix incorrect inheritable capability in CAPSET records'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  audit: fix incorrect inheritable capability in CAPSET records

  __audit_log_capset() records the effective capability set into the
  inheritable field due to a copy-paste …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e68b75a027bb94066576139ee33676264f867b87 <
    75bd76c9eb2de9afeca03dc5152ebca5fb8fc816
  - >-
    Linux >= e68b75a027bb94066576139ee33676264f867b87 <
    febb4bf373ac565d3fb8d1f429827bdd983be496
  - >-
    Linux >= e68b75a027bb94066576139ee33676264f867b87 <
    95de7bb4bf535a9288549d401ebde83cdcbf2792
  - >-
    Linux >= e68b75a027bb94066576139ee33676264f867b87 <
    151ee470edc3d7ed29fe72df678f8357d2ad8ced
  - >-
    Linux >= e68b75a027bb94066576139ee33676264f867b87 <
    0a065c51a225854768b772a0b733a44d77162582
  - >-
    Linux >= e68b75a027bb94066576139ee33676264f867b87 <
    e35f3550c5b4fab33103c18654c293cee9850b0a
  - >-
    Linux >= e68b75a027bb94066576139ee33676264f867b87 <
    d782e4d200cd9036ef353eeb29525bfbfd13a14e
  - >-
    Linux >= e68b75a027bb94066576139ee33676264f867b87 <
    e4a640475e43f406fdfd56d370b1f34b0cbbc18d
  - Linux 2.6.29
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:25:22.858560Z'
published: '2026-06-26'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:18.101Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53287'
references:
  - url: 'https://git.kernel.org/stable/c/75bd76c9eb2de9afeca03dc5152ebca5fb8fc816'
  - url: 'https://git.kernel.org/stable/c/febb4bf373ac565d3fb8d1f429827bdd983be496'
  - url: 'https://git.kernel.org/stable/c/95de7bb4bf535a9288549d401ebde83cdcbf2792'
  - url: 'https://git.kernel.org/stable/c/151ee470edc3d7ed29fe72df678f8357d2ad8ced'
  - url: 'https://git.kernel.org/stable/c/0a065c51a225854768b772a0b733a44d77162582'
  - url: 'https://git.kernel.org/stable/c/e35f3550c5b4fab33103c18654c293cee9850b0a'
  - url: 'https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e'
  - url: 'https://git.kernel.org/stable/c/e4a640475e43f406fdfd56d370b1f34b0cbbc18d'
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.02049
ingestedAt: '2026-11-06T16:57:43.251Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

audit: fix incorrect inheritable capability in CAPSET records

__audit_log_capset() records the effective capability set into the
inheritable field due to a copy-paste error. Every CAPSET audit
record therefore reports cap_pi (process inheritable) with the value
of cap_effective instead of cap_inheritable.

This silently corrupts audit data used for compliance and forensic
analysis: an attacker who modifies inheritable capabilities to
prepare for a privilege-escalating exec would have the change masked
in the audit trail.

The bug has been present since the original introduction of CAPSET
audit records in 2008.

## Affected

- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < 75bd76c9eb2de9afeca03dc5152ebca5fb8fc816`
- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < febb4bf373ac565d3fb8d1f429827bdd983be496`
- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < 95de7bb4bf535a9288549d401ebde83cdcbf2792`
- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < 151ee470edc3d7ed29fe72df678f8357d2ad8ced`
- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < 0a065c51a225854768b772a0b733a44d77162582`
- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < e35f3550c5b4fab33103c18654c293cee9850b0a`
- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < d782e4d200cd9036ef353eeb29525bfbfd13a14e`
- `Linux >= e68b75a027bb94066576139ee33676264f867b87 < e4a640475e43f406fdfd56d370b1f34b0cbbc18d`
- `Linux 2.6.29`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.