CVE-2026-53249 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
Unprivileged users can exploit IPv4 source routing options to leak TCP ISNs and other protocol information by forcing packets through attacker-controlled nodes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53249?
CVE-2026-53249 is a medium-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
This patch restricts setting Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IP options to users with CAP_NET_RAW capability.
This prevents unprivileged applications from forcing packets to route through attacker-controlled nodes to leak TCP ISN and possibly other protocol information.
While LSRR and SSRR are commonly filtered in many network environments, they may still be supported and forwarded along some network paths.
RFC 7126 (Recommendations on Filtering of IPv4 Packets Containing IPv4 Options) recommend to drop these options in 4.3 and 4.4.
Which versions are affected by CVE-2026-53249?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53249?
Apply the vendor's patch.
Is CVE-2026-53249 being exploited?
There is no known exploitation of CVE-2026-53249 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90642, BELL-CVE-2026-53249, DEBIAN-CVE-2026-53249, GHSA-r3wj-w7v3-6mqq, ROOT-OS-DEBIAN-11-CVE-2026-53249, ROOT-OS-DEBIAN-12-CVE-2026-53249 and 3 more.