The Linux kernel accidentally records the effective capability set into the inheritable field of CAPSET audit records due to a copy‑paste defect. Every audit entry therefore shows the wrong value for the inheritable capabilities, effectively masking any user‑initiated changes to that field. An attacker who alters inheritable capabilities in preparation for a privilege‑escalating execution would find those changes invisible in the audit trail, which undermines compliance reporting and forensic investigations.

All systems running the Linux kernel are affected, regardless of distribution, because the vulnerability is present in the core kernel code and no specific version range is supplied. Any Linux installation that has not applied the recent patch that fixes the audit logging error is potentially impacted.

The flaw does not provide direct remote code execution or service disruption, but it enables a local or privileged attacker to conceal privilege escalation attempts, thereby compromising audit integrity. Exploitation requires the ability to manipulate capabilities, typically achievable with root or elevated privileges, so the attack vector is local. The CVSS score is not stated and EPSS data is unavailable, but the bug has existed since 2008, indicating a long‑standing issue that may be leveraged in targeted or compliance‑bypass scenarios. The vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not known, yet the potential impact on forensic soundness warrants prompt action.