The Linux kernel audit function __audit_log_capset() incorrectly records the effective capability set into the inheritable capability field in CAPSET audit records because of a copy-paste error. As a result, audit logs report the process inheritable capability field with the value of the effective capabilities rather than the actual inheritable capabilities. This silent corruption of audit data undermines the reliability of audit trails used for compliance and forensic investigations, potentially hiding attacker activity related to modifying inheritable capabilities to facilitate privilege escalation. The vulnerability has been present since CAPSET audit records were introduced in 2008.

Audit records generated by the Linux kernel do not accurately reflect changes to inheritable capabilities, which can mislead compliance and forensic analysis efforts. While this does not directly enable privilege escalation or compromise system integrity, it impairs detection and investigation of such attacks by masking critical audit trail information. There is no direct confidentiality or integrity impact on the system's capabilities, but the availability of reliable audit data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, defenders should be aware that audit logs may not reliably report inheritable capability changes. Monitoring and forensic analysis should consider this limitation when investigating privilege escalation attempts involving capabilities.