In the Linux kernel, the following vulnerability has been resolved: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options This patch restricts setting… (CVE-2026-53249)
A vulnerability in the Linux kernel related to IPv4 options LSRR and SSRR has been resolved by restricting their use to users with CAP_NET_RAW capability. This prevents unprivileged applications from exploiting these IP options to route packets through attacker-controlled nodes, which could leak TCP ISN and other protocol information. The vulnerability is mitigated by a patch that enforces this restriction. LSRR and SSRR options are often filtered in many networks but may still be forwarded in some environments. RFC 7126 recommends dropping these options to enhance security.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-53249 involves the Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IPv4 options. Previously, unprivileged users could set these options, potentially allowing packets to be routed through attacker-controlled nodes, leading to leakage of TCP Initial Sequence Numbers (ISN) and possibly other protocol data. The patch restricts setting these IP options to users with the CAP_NET_RAW capability, thereby preventing unprivileged exploitation. This aligns with RFC 7126 recommendations to filter such IPv4 options.
Potential Impact
Exploitation could allow unprivileged users to manipulate packet routing to leak TCP ISN and other protocol information, potentially aiding in reconnaissance or further attacks. The vulnerability does not impact confidentiality or integrity directly but affects availability (as per CVSS vector) and could facilitate indirect attacks.
Mitigation Recommendations
A patch has been released that restricts the use of LSRR and SSRR IP options to privileged users with CAP_NET_RAW capability. Applying this patch mitigates the vulnerability. Network administrators should also consider filtering LSRR and SSRR options as recommended by RFC 7126 to reduce exposure.
In the Linux kernel, the following vulnerability has been resolved: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options This patch restricts setting… (CVE-2026-53249)
Description
A vulnerability in the Linux kernel related to IPv4 options LSRR and SSRR has been resolved by restricting their use to users with CAP_NET_RAW capability. This prevents unprivileged applications from exploiting these IP options to route packets through attacker-controlled nodes, which could leak TCP ISN and other protocol information. The vulnerability is mitigated by a patch that enforces this restriction. LSRR and SSRR options are often filtered in many networks but may still be forwarded in some environments. RFC 7126 recommends dropping these options to enhance security.
CVSS v3.1
Score 5.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-53249 involves the Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IPv4 options. Previously, unprivileged users could set these options, potentially allowing packets to be routed through attacker-controlled nodes, leading to leakage of TCP Initial Sequence Numbers (ISN) and possibly other protocol data. The patch restricts setting these IP options to users with the CAP_NET_RAW capability, thereby preventing unprivileged exploitation. This aligns with RFC 7126 recommendations to filter such IPv4 options.
Potential Impact
Exploitation could allow unprivileged users to manipulate packet routing to leak TCP ISN and other protocol information, potentially aiding in reconnaissance or further attacks. The vulnerability does not impact confidentiality or integrity directly but affects availability (as per CVSS vector) and could facilitate indirect attacks.
Mitigation Recommendations
A patch has been released that restricts the use of LSRR and SSRR IP options to privileged users with CAP_NET_RAW capability. Applying this patch mitigates the vulnerability. Network administrators should also consider filtering LSRR and SSRR options as recommended by RFC 7126 to reduce exposure.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-r3wj-w7v3-6mqq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53249"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4e4ee2c9d9e3dbe3289550
Added to database: 07/08/2026, 13:21:38 UTC
Last enriched: 09/08/2026, 14:35:17 UTC
Last updated: 09/14/2026, 22:01:35 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.