CVE-2026-72447
Received Received - Intake

SCTP Diag Endpoint Dump Race Condition in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctp_diag SCTP_DIAG endpoint dumping was traversing endpoint address lists without holding lock_sock(), while those lists could change concurrently via socket operations (e.g., bindx changes). This creates a race where nla_reserve() counts addresses under RCU protection, but the subsequent copy may see fewer entries, potentially leaking uninitialized memory to userspace. Fix this by: - Taking a reference on each endpoint during hash traversal - Moving socket operations (lock_sock()) outside read_lock_bh() - Serializing address list access during dump - Reworking sctp_for_each_endpoint() to support restart-based traversal with (net, pos) tracking Also: - Add WARN_ON_ONCE() for inconsistent address counts - Fix idiag_states filtering for LISTEN vs association cases - Skip dumping endpoints being freed (ep->base.dead) - Move dump position tracking into iterator, removing cb->args[4] and its comment for sctp_ep_dump()., - Update the comment for cb->args[4] and remove the comment for unused cb->args[5] for sctp_sock_dump(). Note: traversal is restart-based and may re-scan buckets multiple times, but this is acceptable due to small bucket sizes and required to support sleeping-safe callbacks. This issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero Day Initiative.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72447
EUVD
EUVD-2026-59346

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the SCTP_DIAG endpoint dumping function. The issue occurs when the function accesses endpoint address lists without proper locking, allowing concurrent socket operations to modify the lists. This can lead to a mismatch between the number of addresses counted and those actually copied, potentially exposing uninitialized memory to userspace.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCTP_DIAG endpoint dumping mechanism. Detection requires checking if your kernel version includes the vulnerable code path. Use commands like 'uname -a' to check kernel version and 'dmesg' or 'journalctl' to look for kernel warnings related to SCTP or sctp_diag. No direct network detection commands are provided in the context.

Impact Analysis

An attacker could exploit this flaw to read uninitialized memory from the kernel, potentially gaining access to sensitive information. This could include data from other processes or kernel memory, posing a risk to system security and stability.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for CVE-2026-72447. Check your distribution's security advisories for kernel updates. If updating is not immediately possible, consider disabling SCTP_DIAG functionality if not required, though this may impact monitoring tools.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72447. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart