CVE-2026-68162

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: avoid auth_enable sysctl UAF during netns teardown

proc_sctp_do_auth() updates the SCTP control socket after changing

net.sctp.auth_enable. The handler gets the per-net SCTP state from

ctl->data, so an already opened sysctl file can still target a network

namespace while that namespace is being torn down.

SCTP previously registered its per-net sysctls from sctp_defaults_init(),

while the control socket is created later from sctp_ctrlsock_init(). This

exposed a window during initialization where auth_enable was writable

before net->sctp.ctl_sock existed, and a teardown window where auth_enable

stayed writable after inet_ctl_sock_destroy() had released the control

socket.

Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after

sctp_ctl_sock_init() succeeds, and unregister the sysctl table before

destroying the control socket in sctp_ctrlsock_exit(). If sysctl

registration fails after the contr

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References