CVE-2026-53367 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
selinux: fix avdcache auditing
The per-task avdcache was incorrectly saving and reusing the audited vector computed by avc_audit_required() rather than recomputing based on the currently requested permissions and distinguishing the denied versus allowed cases. As a result, some permission checks were not being audited, e.g. directory write checks after a previously cached directory search check.
[PM: line wrap tweaks]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question relates to the Security-Enhanced Linux (SELinux) implementation within the Linux kernel, specifically addressing an issue with the avdcache auditing mechanism. This flaw represents a critical weakness in the kernel's mandatory access control system that could potentially allow unauthorized access attempts to go undetected. The problem manifests in how SELinux handles audit logging for access decisions, creating a scenario where security events are not properly recorded due to incorrect caching behavior.
The technical root cause involves the per-task avdcache mechanism which is designed to optimize performance by caching access vector decisions. However, the implementation incorrectly stores and reuses audit vectors computed by the avc_audit_required() function without proper recomputation based on current permission requests. This caching error occurs because the system fails to distinguish between allowed and denied permission cases when retrieving cached audit information, leading to situations where previously cached search permissions influence subsequent write operations that should be independently audited.
This vulnerability directly impacts the integrity of the security logging infrastructure by creating blind spots in audit trails. When a user performs a directory search operation followed by a write operation, the system incorrectly assumes that the write permission check should inherit the audit status from the previous search operation rather than performing independent evaluation. This creates a scenario where legitimate security violations may not be logged, potentially masking malicious activities or unauthorized access attempts within the system.
The operational impact of this vulnerability extends beyond simple logging failures to compromise the effectiveness of security monitoring and incident response capabilities. Organizations relying on SELinux for mandatory access control may experience false negatives in their security audit logs, making it difficult to detect potential security breaches or policy violations. The issue affects systems where users perform sequential operations on directory structures, particularly when transitioning from read/search permissions to write operations, creating opportunities for unauthorized modifications to go undetected.
This vulnerability aligns with CWE-254, which addresses the weakness of inadequate audit logging or monitoring, and relates to ATT&CK technique T1070.001 for indicator removal through deletion of logs. The flaw represents a failure in proper access control decision-making that undermines the fundamental security guarantees provided by SELinux. Security professionals should note that this issue affects the core auditing functionality of the Linux kernel's security framework, potentially allowing attackers to exploit the audit gaps while remaining undetected.
The fix for this vulnerability requires modifications to how the avdcache mechanism handles audit vector computations, ensuring that each permission check undergoes proper recomputation based on current access requirements rather than relying on cached audit status. This correction maintains performance optimizations while ensuring complete and accurate security logging. Organizations should prioritize applying this patch to maintain the integrity of their SELinux-based security policies and ensure comprehensive audit coverage for all access decisions within their systems.
The resolution addresses a critical gap in the kernel's security architecture by restoring proper separation between different permission types and their respective auditing requirements. This fix ensures that each access decision, regardless of its relationship to previous operations, undergoes independent evaluation for audit logging purposes. The implementation demonstrates the importance of maintaining proper access control boundaries even when performance optimizations are applied to security subsystems.
This vulnerability highlights the complex interplay between security system performance and audit completeness in kernel-level security implementations. The fix represents a balance between maintaining efficient access control mechanisms while preserving the comprehensive auditing capabilities essential for effective security monitoring and compliance requirements across enterprise and government environments where SELinux deployments are common.