Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to trigger an out-of-bounds memory read. This occurs when the system attempts to retrieve diagnostic information about a network connection that has already been closed or freed. While primarily impacting system stability, it could potentially lead to the exposure of sensitive kernel memory or cause a system crash.
Technical details
A race condition exists in net/sctp/diag.c where an exact sock_diag lookup can hold a transport reference and block on lock_sock(sk) while the association is being freed. If sctp_association_free() marks the association as dead and clears the bind address list before the diagnostic path resumes, functions like inet_diag_msg_sctpasoc_fill() may dereference invalid or empty lists. This results in an out-of-bounds read from unrelated kernel memory. The fix introduces a check to reject associations that have been reaped or detached from their endpoint after the socket lock is acquired.
Affected products
- Linux Linux Kernel 8f840e47f190 to 6657af827e21
Timeline
- 2026-05-30: other: Vulnerability fix authored
- 2026-06-02: other: Patch committed to mainline kernel
- 2026-06-19: patched: Patch committed to stable branches
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/480f754580b5686b928977d16a59f20cef83ff01
- https://git.kernel.org/stable/c/5425de8bd6e9fe5bd67d158e3348171ae7510117
- https://git.kernel.org/stable/c/5eba3e48d78edd7551b992cb7ba687019b3a78da
- https://git.kernel.org/stable/c/6657af827e21883ae90693e42e7f59a6aab690b5
- https://git.kernel.org/stable/c/78c4f964b2f94e405721c093773f6250e1e676b2
- https://git.kernel.org/stable/c/b2be72d401833194917e44fbd8d8144bb4f2db16
- https://git.kernel.org/stable/c/e97c2a535e23ed0fdd2660993fb3f10d9535c9bc