{"cve":"CVE-2026-53249","nvd":{"published":"2026-06-25T09:16:42.847","modified":"2026-10-15T02:20:06.720","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: restrict IPOPT_SSRR and IPOPT_LSRR options\n\nThis patch restricts setting Loose Source and Record Route (LSRR)\nand Strict Source and Record Route (SSRR) IP options to users\nwith CAP_NET_RAW capability.\n\nThis prevents unprivileged applications from forcing packets to route\nthrough attacker-controlled nodes to leak TCP ISN and possibly other\nprotocol information.\n\nWhile LSRR and SSRR are commonly filtered in many network environments,\nthey may still be supported and forwarded along some network paths.\n\nRFC 7126 (Recommendations on Filtering of IPv4 Packets Containing\nIPv4 Options) recommend to drop these options in 4.3 and 4.4.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/00e8845fe3428c69e980dce5071cb3da1d8f7578","https://git.kernel.org/stable/c/28f5ad1b4055405eb1616e603fe511ba5e3725e7","https://git.kernel.org/stable/c/2a87c3e8f03ce655ed0ef500d64d5fd924ec3691","https://git.kernel.org/stable/c/4cd6e9ed49347d3a2fdaaf07e32fb524756dddc2","https://git.kernel.org/stable/c/89343ff12b3178fc236fe531a3603e7c97c68278"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:41:17.107060303+00:00"},"epss":{"cve":"CVE-2026-53249","score":0.00129,"percentile":0.02495,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}