SELinux was not updated when TCP Fast Open support was added to the Linux kernel, causing the socket_sendmsg() hook to omit a selinux_socket_connect() check when MSG_FASTOPEN is used. As a result, processes could initiate connections using TCP Fast Open without SELinux verifying the usual connect‑related permissions. This omission allows an attacker to bypass SELinux policy enforcement on those connections, potentially enabling privilege escalation or unauthorized network activity. The flaw is a classic missing proper access control on a privileged operation, as reflected by CWE‑284.

All Linux kernels that incorporated TCP Fast Open without the corresponding SELinux permission check are affected. Specific vendor and product names are Linux, Linux. Exact version ranges are not listed in the data provided, so the vulnerability may exist in any kernel version where the change was introduced before the patch, across all distributions that ship the upstream kernel.

The EPSS value is unavailable and the vulnerability is not included in the CISA KEV catalog, which suggests there is no publicly known exploitation activity. However, the missing SELinux check may be exploitable by an attacker who can create or control a process capable of using the TCP Fast Open feature, enabling bypass of SELinux enforced network restrictions. The attack vector is inferred to be local or remote depending on the system’s network configuration, but the vulnerability does not provide a means to gain privileges if the attacker cannot install code or compromise a privileged process. Given the lack of official exploitation reports, the overall risk is considered low but remediated through patching to eliminate the possibility of bypass.