---
id: CVE-2026-72243
title: 'selinux: check connect-related permissions on TCP Fast Open'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  selinux: check connect-related permissions on TCP Fast Open

  Similar to Landlock, SELinux was not updated when TCP Fast Open
  support was introduced to ensure connect-re…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cf60af03ca4e71134206809ea892e49b92a88896 <
    11406d0d7e11b4e525bb2ace2c70107031d058da
  - >-
    Linux >= cf60af03ca4e71134206809ea892e49b92a88896 <
    e507633bf76bccf1a6af27771fb0d6e2862b7eac
  - >-
    Linux >= cf60af03ca4e71134206809ea892e49b92a88896 <
    d028bc080a0dcd6a7f8e1ae1bd32dda696505ba3
  - >-
    Linux >= cf60af03ca4e71134206809ea892e49b92a88896 <
    fc633a598206d4f23af782db7c0b5f3a82751d2c
  - >-
    Linux >= cf60af03ca4e71134206809ea892e49b92a88896 <
    646ebbc5f2ff9147d084e1213143f091026a611c
  - >-
    Linux >= cf60af03ca4e71134206809ea892e49b92a88896 <
    44c74d27d1b9aaa99fa8a83640c1223575262b80
  - Linux 3.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:44:53.438037Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:45:04.616Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72243'
references:
  - url: 'https://git.kernel.org/stable/c/11406d0d7e11b4e525bb2ace2c70107031d058da'
  - url: 'https://git.kernel.org/stable/c/e507633bf76bccf1a6af27771fb0d6e2862b7eac'
  - url: 'https://git.kernel.org/stable/c/d028bc080a0dcd6a7f8e1ae1bd32dda696505ba3'
  - url: 'https://git.kernel.org/stable/c/fc633a598206d4f23af782db7c0b5f3a82751d2c'
  - url: 'https://git.kernel.org/stable/c/646ebbc5f2ff9147d084e1213143f091026a611c'
  - url: 'https://git.kernel.org/stable/c/44c74d27d1b9aaa99fa8a83640c1223575262b80'
tags:
  - cve.org
epss: 0.00166
epssPercentile: 0.05427
ingestedAt: '2026-10-16T19:46:24.420Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

selinux: check connect-related permissions on TCP Fast Open

Similar to Landlock, SELinux was not updated when TCP Fast Open
support was introduced to ensure connect-related permissions are
checked when using TCP Fast Open. Update its socket_sendmsg() hook to
call selinux_socket_connect() when MSG_FASTOPEN is passed.

## Affected

- `Linux >= cf60af03ca4e71134206809ea892e49b92a88896 < 11406d0d7e11b4e525bb2ace2c70107031d058da`
- `Linux >= cf60af03ca4e71134206809ea892e49b92a88896 < e507633bf76bccf1a6af27771fb0d6e2862b7eac`
- `Linux >= cf60af03ca4e71134206809ea892e49b92a88896 < d028bc080a0dcd6a7f8e1ae1bd32dda696505ba3`
- `Linux >= cf60af03ca4e71134206809ea892e49b92a88896 < fc633a598206d4f23af782db7c0b5f3a82751d2c`
- `Linux >= cf60af03ca4e71134206809ea892e49b92a88896 < 646ebbc5f2ff9147d084e1213143f091026a611c`
- `Linux >= cf60af03ca4e71134206809ea892e49b92a88896 < 44c74d27d1b9aaa99fa8a83640c1223575262b80`
- `Linux 3.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.