CVE-2026-72447

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: hold socket lock when dumping endpoints in sctp_diag

SCTP_DIAG endpoint dumping was traversing endpoint address lists without

holding lock_sock(), while those lists could change concurrently via

socket operations (e.g., bindx changes). This creates a race where

nla_reserve() counts addresses under RCU protection, but the subsequent

copy may see fewer entries, potentially leaking uninitialized memory to

userspace.

Fix this by:

- Taking a reference on each endpoint during hash traversal

- Moving socket operations (lock_sock()) outside read_lock_bh()

- Serializing address list access during dump

- Reworking sctp_for_each_endpoint() to support restart-based traversal

with (net, pos) tracking

Also:

- Add WARN_ON_ONCE() for inconsistent address counts

- Fix idiag_states filtering for LISTEN vs association cases

- Skip dumping endpoints being freed (ep->base.dead)

- Move dump position tracking into iterator, rem

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References