CVE-2026-72243 is a SELinux bypass via TCP Fast Open (TFO) that went undetected for fourteen years — from kernel 3.13 (2012) until this disclosure in 2026. The mechanism is straightforward: MSG_FASTOPEN initiates a connection inside sendmsg() rather than connect(), bypassing the selinux_socket_connect() hook entirely. A connection initiated with MSG_FASTOPEN skips the connect permission check that SELinux expects to enforce.
The fix adds a conditional call to selinux_socket_connect() inside socket_sendmsg() when MSG_FASTOPEN is present — but this isn't a surgical correction. It's grafting connect semantics onto a send path that was never designed to carry them, creating a new intersection point where two security enforcement domains must stay synchronized forever. Every future security module touching this code path must now reason about this conditional, or inherit the same gap.
What matters most: this is not an isolated oversight. The same pattern — feature ships with a performance shortcut, security modules get patched reactively, the system's permission surface is smaller than intended for years — has repeated across io_uring, AF_XDP, AF_ALG, early seccomp notifications, and XDP. The sequence is genetic: performance optimization ships, security review follows, CVE drops years later. The CVE score of 8.4 reflects acute severity but ignores the compounding: every year without disclosure was a year exploit tooling matured, deployment grew, and the gap remained unexamined.
For defenders, the priority is immediate: ensure your kernel version includes the selinux_socket_connect() call in socket_sendmsg() for MSG_FASTOPEN. Beyond patching, treat this as evidence that your threat model likely has similar gaps elsewhere — syscall flags that alter semantic meaning without triggering parallel security checks. The practical detection challenge is that there's no artifact to audit: no security module declaration of which flags matter, no integration test that validates permission enforcement across all connection-initiation paths. You are flying partially blind until someone finds the next one. The systemic answer — reducing this vulnerability class — requires architectural change, not coordination improvement: security modules must be co-authors of syscall interfaces, not consumers retrofitting onto them.