In the Linux kernel, the following vulnerability has been resolved:
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
This patch restricts setting Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IP options to users with CAP_NET_RAW capability.
This prevents unprivileged applications from forcing packets to route through attacker-controlled nodes to leak TCP ISN and possibly other protocol information.
While LSRR and SSRR are commonly filtered in many network environments, they may still be supported and forwarded along some network paths.
RFC 7126 (Recommendations on Filtering of IPv4 Packets Containing IPv4 Options) recommend to drop these options in 4.3 and 4.4.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernelUpgrade kernel-livepatch-5.10.259-258.1043Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade perfUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.210-148.245 | Jul 8, 2026 | Jul 8, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel6.18-modules-extra-commonUpgrade python3-perf6.18-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel6.18-tools-develUpgrade kernel6.12-headersUpgrade kernel6.12-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel6.12-develUpgrade kernel6.18-develUpgrade kernel-develUpgrade perf6.18Upgrade kernel6.12-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.18-tools-debuginfoUpgrade kernel6.18Upgrade microvm-kernel6.18Upgrade python3-perf6.12Upgrade kernel-toolsUpgrade perf6.12Upgrade python3-perf-debuginfoUpgrade bpftool6.18Upgrade kernelUpgrade kernel6.12-tools-develUpgrade python3-perf6.18Upgrade kernel-modules-extraUpgrade bpftoolUpgrade perf-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel6.18-debuginfo-common-aarch64Upgrade python3-perfUpgrade perf6.18-debuginfoUpgrade kernel-livepatch-6.18.36-69.134Upgrade kernel6.12Upgrade kernel6.18-headersUpgrade bpftool6.18-debuginfoUpgrade perfUpgrade kernel-livepatch-6.1.176-220.358Upgrade kernel6.18-toolsUpgrade kernel-headersUpgrade kernel-livepatch-6.12.94-123.174Upgrade kernel-debuginfo-common-aarch64Upgrade bpftool6.12-debuginfoUpgrade bpftool6.12Upgrade kernel6.18-modules-extraUpgrade kernel-modules-extra-commonUpgrade kernel6.12-toolsUpgrade kernel6.18-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-modules-extraUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-tools-devel | Jul 8, 2026 | Jun 25, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jul 5, 2026 | Jul 5, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Jun 25, 2026 |
| Ubuntu | — | Upgrade linux-image-oracleUpgrade linux-image-7.0.0-31-generic-64kUpgrade linux-image-7.0.0-1013-ibmUpgrade linux-image-gke-64kUpgrade linux-image-nvidia-64k-7.0Upgrade linux-image-oem-26.04bUpgrade linux-image-aws-7.0Upgrade linux-image-realtime-7.0Upgrade linux-image-7.0.0-1019-raspiUpgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-virtual-hwe-26.04Upgrade linux-image-gke-7.0Upgrade linux-image-gke-hwe-26.04Upgrade linux-image-gcp-7.0Upgrade linux-image-oracle-7.0Upgrade linux-image-7.0.0-1019-raspi-realtimeUpgrade linux-image-aws-64k-7.0Upgrade linux-image-virtualUpgrade linux-image-7.0.0-1011-oracle-64kUpgrade linux-image-ibmUpgrade linux-image-nvidia-bosUpgrade linux-image-7.0.0-31-realtimeUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-ibm-7.0Upgrade linux-image-7.0.0-31-realtime-64kUpgrade linux-image-gkeUpgrade linux-image-7.0.0-1006-gkeUpgrade linux-image-7.0.0-1013-oemUpgrade linux-image-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-raspi-realtime-7.0Upgrade linux-image-7.0.0-2018-nvidia-bos-64kUpgrade linux-image-nvidia-7.0Upgrade linux-image-genericUpgrade linux-image-nvidiaUpgrade linux-image-azure-lts-26.04Upgrade linux-image-virtual-7.0Upgrade linux-image-7.0.0-1012-aws-64kUpgrade linux-image-oem-26.04aUpgrade linux-image-7.0.0-1018-nvidia-64kUpgrade linux-image-realtime-64kUpgrade linux-image-awsUpgrade linux-image-gcp-64kUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-7.0.0-1011-oracleUpgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-oem-26.04Upgrade linux-image-generic-7.0Upgrade linux-image-gcpUpgrade linux-image-7.0.0-31-genericUpgrade linux-image-7.0.0-2018-nvidia-bosUpgrade linux-image-7.0.0-1014-azureUpgrade linux-image-aws-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-realtimeUpgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-oem-7.0Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-nvidia-bos-64kUpgrade linux-image-generic-hwe-26.04Upgrade linux-image-realtime-hwe-26.04Upgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-gcp-64k-7.0Upgrade linux-image-realtime-64k-7.0Upgrade linux-image-7.0.0-1018-nvidiaUpgrade linux-image-azure-7.0Upgrade linux-image-gke-64k-7.0Upgrade linux-image-7.0.0-1006-gke-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-oracle-64kUpgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-7.0Upgrade linux-image-7.0.0-1012-awsUpgrade linux-image-raspi-7.0Upgrade linux-image-raspiUpgrade linux-image-azureUpgrade linux-image-oracle-64k-7.0 | Sep 14, 2026 | Sep 7, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 10, 2026 | Jun 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub