CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options

Published Jun 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ipv4: restrict IPOPTSSRR and IPOPTLSRR options

This patch restricts setting Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IP options to users with CAPNETRAW capability.

This prevents unprivileged applications from forcing packets to route through attacker-controlled nodes to leak TCP ISN and possibly other protocol information.

While LSRR and SSRR are commonly filtered in many network environments, they may still be supported and forwarded along some network paths.

RFC 7126 (Recommendations on Filtering of IPv4 Packets Containing IPv4 Options) recommend to drop these options in 4.3 and 4.4.

Affected Software

20 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.141.1-1<6.6.143.1-1
6.6.143.1-1
Linux Linux kernel>=2.6.12.1<5.10.259
Linux Linux kernel>=5.11<5.15.210
Linux Linux kernel>=5.16<6.1.176
Linux Linux kernel>=6.2<6.6.143
Linux Linux kernel>=6.7<6.12.94
Linux Linux kernel>=6.13<6.18.36
Linux Linux kernel>=6.19<7.0.13
Linux Linux kernel=2.6.12
Linux Linux kernel=2.6.12-rc2
Linux Linux kernel=2.6.12-rc3
Linux Linux kernel=2.6.12-rc4
Linux Linux kernel=2.6.12-rc5
Linux Linux kernel=7.1-rc1
Linux Linux kernel=7.1-rc2
Linux Linux kernel=7.1-rc3
Linux Linux kernel=7.1-rc4
Linux Linux kernel=7.1-rc5
Linux Linux kernel=7.1-rc6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.6.143.1-1
  2. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Fixed in 4.3
  3. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Fixed in 4.4
  4. Configuration

    In the Linux kernel, restrict/drop the IPv4 IP options IPOPT_SSRR and IPOPT_LSRR as recommended for versions 4.3 and 4.4 to prevent unprivileged applications (even with CAP_NET_RAW) from forcing packets to route and potentially leaking TCP ISN or other protocol information via attacker-controlled nodes.

    Linux kernel IPv4 (IP options) IP option handling for IPOPT_SSRR and IPOPT_LSRR = restrict (drop these options)

Event History

Jun 25, 2026
CVE Published
via MITRE·08:39 AM
Data Sourced
via MITRE·08:39 AM
Description
Data Sourced
via NVD·09:16 AM
RemedyDescriptionSeverityAffected Software
Jun 27, 2026
Data Sourced
via Microsoft·08:10 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:10 AM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2026-53249?

The severity of CVE-2026-53249 is rated as 37.

2

How do I fix CVE-2026-53249?

To address CVE-2026-53249, ensure that your Linux kernel is updated to a version that restricts settings for IPOPT_SSRR and IPOPT_LSRR options.

3

What does CVE-2026-53249 affect?

CVE-2026-53249 affects the Linux kernel, specifically its handling of Loose Source and Record Route and Strict Source and Record Route IP options.

4

Who is affected by CVE-2026-53249?

CVE-2026-53249 primarily affects users with unprivileged access attempting to set specific IP options.

5

What is the impact of CVE-2026-53249?

The impact of CVE-2026-53249 is the prevention of unprivileged users from setting certain IP options, thereby enhancing network security.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203