CVE-2026-63828

In the Linux kernel, the following vulnerability has been resolved:

apparmor: mediate the implicit connect of TCP fast open sendmsg

sendmsg()/sendto() with MSGFASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmorsocketsendmsg() only checks AAMAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP connection that connect(2) would have refused, bypassing connect mediation.

Mediate the implicit connect when MSGFASTOPEN is set and a destination is supplied. Add it to apparmorsocketsendmsg() (not the shared aasockmsgperm() helper, which recvmsg also uses) and call aaskperm() directly, mirroring the selinux and tomoyo fixes. skistcp() does not cover MPTCP fast open, so the SOCKSTREAM/IPPROTOMPTCP arm is explicit.