Junglewise Threat Intelligence

CVE-2026-52917: Linux Kernel out-of-bounds read in SCTP diag component

CVE-2026-52917 · Severity: info · CVSS 4.4 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to trigger an out-of-bounds memory read. This occurs when the system attempts to retrieve diagnostic information about a network connection that has already been closed or freed. While primarily impacting system stability, it could potentially lead to the exposure of sensitive kernel memory or cause a system crash.

Technical details

A race condition exists in net/sctp/diag.c where an exact sock_diag lookup can hold a transport reference and block on lock_sock(sk) while the association is being freed. If sctp_association_free() marks the association as dead and clears the bind address list before the diagnostic path resumes, functions like inet_diag_msg_sctpasoc_fill() may dereference invalid or empty lists. This results in an out-of-bounds read from unrelated kernel memory. The fix introduces a check to reject associations that have been reaped or detached from their endpoint after the socket lock is acquired.

Affected products

  • Linux Linux Kernel 8f840e47f190 to 6657af827e21

Timeline

  • 2026-05-30: other: Vulnerability fix authored
  • 2026-06-02: other: Patch committed to mainline kernel
  • 2026-06-19: patched: Patch committed to stable branches
  • 2026-06-24: disclosed: CVE published

References

Related threats