CVE-2026-53249

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options<br /> <br /> This patch restricts setting Loose Source and Record Route (LSRR)<br /> and Strict Source and Record Route (SSRR) IP options to users<br /> with CAP_NET_RAW capability.<br /> <br /> This prevents unprivileged applications from forcing packets to route<br /> through attacker-controlled nodes to leak TCP ISN and possibly other<br /> protocol information.<br /> <br /> While LSRR and SSRR are commonly filtered in many network environments,<br /> they may still be supported and forwarded along some network paths.<br /> <br /> RFC 7126 (Recommendations on Filtering of IPv4 Packets Containing<br /> IPv4 Options) recommend to drop these options in 4.3 and 4.4.