CVE-2026-68162

Received Received - Intake

Use-After-Free in Linux Kernel SCTP

Publication date: 2026-08-10

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid auth_enable sysctl UAF during netns teardown proc_sctp_do_auth() updates the SCTP control socket after changing net.sctp.auth_enable. The handler gets the per-net SCTP state from ctl->data, so an already opened sysctl file can still target a network namespace while that namespace is being torn down. SCTP previously registered its per-net sysctls from sctp_defaults_init(), while the control socket is created later from sctp_ctrlsock_init(). This exposed a window during initialization where auth_enable was writable before net->sctp.ctl_sock existed, and a teardown window where auth_enable stayed writable after inet_ctl_sock_destroy() had released the control socket. Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after sctp_ctl_sock_init() succeeds, and unregister the sysctl table before destroying the control socket in sctp_ctrlsock_exit(). If sysctl registration fails after the control socket was created, destroy the control socket in the same init path. Make sctp_sysctl_net_unregister() tolerate a missing header and clear the saved pointer so init-error and exit paths can safely share the unregister helper.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68162

EUVD

EUVD-2026-55548

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free (UAF) issue in the SCTP protocol's auth_enable sysctl handling. It occurs during network namespace teardown when proc_sctp_do_auth() updates the SCTP control socket after modifying net.sctp.auth_enable. The sysctl file can target a namespace even while it is being destroyed, due to improper timing in sysctl registration and control socket creation.

Detection Guidance

This vulnerability involves a use-after-free (UAF) condition in the Linux kernel's SCTP implementation during network namespace teardown. Detection requires checking for kernel logs or crashes related to SCTP sysctl handling. Monitor for kernel oops or panic messages involving sctp or auth_enable. Check if your kernel version matches affected versions (not specified here). Use commands like dmesg | grep sctp or journalctl -k | grep sctp to inspect logs.

Impact Analysis

This vulnerability could allow an attacker to trigger a use-after-free condition, potentially leading to system crashes, privilege escalation, or other unintended behavior. Systems using SCTP with auth_enable sysctl enabled may be affected during network namespace operations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it involves a Linux kernel memory management issue in SCTP protocol handling during network namespace teardown. Compliance impacts would only occur if the vulnerability were exploited to cause system instability or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version where this issue is resolved. Since the vulnerability is in the kernel itself, patching is the primary solution. Check your distribution's security advisories for kernel updates. Avoid manual sysctl modifications to auth_enable during runtime. If updating is not immediately possible, restrict access to sysctl interfaces or disable SCTP if not required.

Hi! I’m here to help you understand CVE-2026-68162. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...