CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
In the Linux kernel, the following vulnerability has been resolved:
ipv4: restrict IPOPTSSRR and IPOPTLSRR options
This patch restricts setting Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IP options to users with CAPNETRAW capability.
This prevents unprivileged applications from forcing packets to route through attacker-controlled nodes to leak TCP ISN and possibly other protocol information.
While LSRR and SSRR are commonly filtered in many network environments, they may still be supported and forwarded along some network paths.
RFC 7126 (Recommendations on Filtering of IPv4 Packets Containing IPv4 Options) recommend to drop these options in 4.3 and 4.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 4.3 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 4.4 - Configuration
In the Linux kernel, restrict/drop the IPv4 IP options IPOPT_SSRR and IPOPT_LSRR as recommended for versions 4.3 and 4.4 to prevent unprivileged applications (even with CAP_NET_RAW) from forcing packets to route and potentially leaking TCP ISN or other protocol information via attacker-controlled nodes.
Linux kernel IPv4 (IP options) IP option handling for IPOPT_SSRR and IPOPT_LSRR = restrict (drop these options)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53249?
The severity of CVE-2026-53249 is rated as 37.
How do I fix CVE-2026-53249?
To address CVE-2026-53249, ensure that your Linux kernel is updated to a version that restricts settings for IPOPT_SSRR and IPOPT_LSRR options.
What does CVE-2026-53249 affect?
CVE-2026-53249 affects the Linux kernel, specifically its handling of Loose Source and Record Route and Strict Source and Record Route IP options.
Who is affected by CVE-2026-53249?
CVE-2026-53249 primarily affects users with unprivileged access attempting to set specific IP options.
What is the impact of CVE-2026-53249?
The impact of CVE-2026-53249 is the prevention of unprivileged users from setting certain IP options, thereby enhancing network security.