🟡 Medium | Source: Microsoft Security Response Center
CVE-2026-63828 is a Linux kernel vulnerability relating to AppArmor’s failure to mediate implicit TCP connections made via the TCP Fast Open (TFO) sendmsg path. This means that AppArmor security policies intended to restrict network access could be bypassed for certain outbound TCP connections, potentially allowing processes to communicate with endpoints they should be prohibited from reaching. The issue affects Linux-based Azure workloads where AppArmor is used as a mandatory access control mechanism.
Security Architect’s Take: Review any Azure Linux VMs, AKS node pools, or container workloads that rely on AppArmor profiles for network access control, and apply the relevant kernel patch as soon as it is available via your distribution’s update channel. In the interim, consider whether TCP Fast Open can be disabled at the OS level on sensitive workloads to reduce exposure.
Original advisory: CVE-2026-63828 apparmor: mediate the implicit connect of TCP fast open sendmsg