CVE-2026-52917: sctp: diag: reject stale associations in dump_one path
In the Linux kernel, the following vulnerability has been resolved:
sctp: diag: reject stale associations in dumpone path
The SCTP exact sockdiag lookup can hold a transport reference, block on locksock(sk), and then resume after sctpassociationfree() has marked the association dead and freed its bind address list.
When that happens, inetassocattrsize() and inetdiagmsgsctpasocfill() can still dereference association state that is no longer valid for reporting. In particular, inetdiagmsgsctpasocfill() may read an empty bind-address list as a real sctpsockaddrentry and trigger an out-of-bounds read from unrelated association memory.
Reject the association after taking the socket lock if it has been reaped or detached from the endpoint, and report the lookup as stale. This keeps the exact dump-one path from formatting torn association state.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52917?
CVE-2026-52917 has a risk score of 37, indicating it poses a notable security vulnerability.
How do I fix CVE-2026-52917?
To resolve CVE-2026-52917, users should update their Linux kernel to the latest version that includes the patch for this vulnerability.
What components are affected by CVE-2026-52917?
CVE-2026-52917 affects the SCTP (Stream Control Transmission Protocol) implementation in the Linux kernel.
Is CVE-2026-52917 exploitable in production environments?
Yes, CVE-2026-52917 could potentially be exploited in production environments if not mitigated through updates.
When was CVE-2026-52917 published?
CVE-2026-52917 was published on June 24, 2026.