CVE-2026-72413
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix err_chunk memory leaks in INIT handling When sctp_verify_init() encounters unrecognized parameters, it allocates an err_chunk to report them. However, this chunk is leaked in several code paths: 1. In sctp_sf_do_5_1B_init(), if security_sctp_assoc_request() fails after sctp_verify_init() has populated err_chunk, the function returns immediately without freeing it. 2. In sctp_sf_do_unexpected_init(), the same leak occurs on the security_sctp_assoc_request() failure path. 3. In sctp_sf_do_unexpected_init(), on the success path after copying unrecognized parameters to the INIT-ACK, the function returns without freeing err_chunk, unlike sctp_sf_do_5_1B_init() which properly frees it. Fix all three leaks by adding sctp_chunk_free(err_chunk) calls before returning in the error paths and on the success path in sctp_sf_do_unexpected_init().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72413
EUVD
EUVD-2026-59312

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves memory leaks in the SCTP (Stream Control Transmission Protocol) INIT handling. When unrecognized parameters are encountered during SCTP connection setup, an error chunk is allocated to report them. However, this error chunk is not properly freed in several code paths, leading to memory leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCTP implementation and may not have direct network detection commands. To check if your system is affected, verify the kernel version and whether it includes the vulnerable code paths. Use commands like 'uname -r' to check the kernel version and 'dmesg | grep sctp' to look for SCTP-related errors or warnings.

Impact Analysis

The memory leaks could lead to gradual exhaustion of system memory, potentially causing performance degradation or system instability over time. This is particularly problematic for systems running long-term services that handle many SCTP connections.

Mitigation Strategies

Apply the latest kernel updates or patches that address this vulnerability. If patches are not available, consider disabling SCTP if it is not required, as this vulnerability is specific to SCTP handling. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72413. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart