Executive brief
The Linux kernel's SCTP (Stream Control Transmission Protocol) diagnostics feature had a race condition when dumping endpoint information. This allowed memory that should be protected to leak to unprivileged user-space processes, potentially exposing sensitive kernel memory contents. An attacker with access to read SCTP diagnostics could extract uninitialized kernel data.
Technical details
The vulnerability is a classic race condition in the sctp_diag endpoint dumping code. The function traversed SCTP endpoint address lists without holding lock_sock(), while those lists could be modified concurrently by socket operations (e.g., bindx address changes). During dumping, nla_reserve() would count addresses under RCU protection, but the subsequent copy operation could see fewer entries, causing the copy to write less data than reserved, leaving uninitialized memory in the buffer that gets sent to userspace. The fix involves: taking references on endpoints during traversal, moving lock_sock() operations outside RCU locks, serializing address list access, and reworking sctp_for_each_endpoint() to support restart-based traversal with proper position tracking.
Affected products
- Linux Linux kernel multiple versions (fix committed for stable branches 4.19+, 5.x, 6.x, 7.x)
Timeline
- 2026-08-15: disclosed: CVE-2026-72447 published on NVD
- 2026-06-15: patched: Fix committed upstream (commit 7d8297e26b4e20b5d1c3c3fe51fe81a1c7fbc823)
- 2026-07-24: patched: Fix applied to stable kernel trees