SELinux was not updated to enforce connect permissions when TCP Fast Open was added to the Linux kernel. The socket_sendmsg() hook omitted a selinux_socket_connect() check when MSG_FASTOPEN was passed, enabling processes to establish connections without SELinux verifying the usual permission checks. This flaw can lead to a bypass of SELinux policy enforcement on such connections, potentially allowing unauthorized network activity. The weakness is a missing permission check (CWE-551).

All Linux kernel builds that include TCP Fast Open support without the corresponding SELinux change are affected. The vendor list identifies the product as Linux:Linux, and the CPE string indicates the kernel. Because the update to selinux_socket_connect() was not applied until after the change, any kernel version that introduced TCP Fast Open prior to 2026‑72243 is potentially vulnerable. Exact version releases are not specified, so users should assume that kernels before the patch are impacted.

The CVSS score of 8.4 indicates high severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, implying no known public exploitation. The attack vector is likely local, because a process with the ability to call socket_sendmsg() with MSG_FASTOPEN may bypass SELinux, but remote exploitation would require the attacker to influence that process. Inference: the likely attack scenario is a local attacker or a compromised service that can generate a TCP Fast Open request. While there are no documented exploits, the high severity and local privilege requirement still warrant remediation.