CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown
In the Linux kernel, the following vulnerability has been resolved:
sctp: avoid authenable sysctl UAF during netns teardown
procsctpdoauth() updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl->data, so an already opened sysctl file can still target a network namespace while that namespace is being torn down.
SCTP previously registered its per-net sysctls from sctpdefaultsinit(), while the control socket is created later from sctpctrlsockinit(). This exposed a window during initialization where authenable was writable before net->sctp.ctlsock existed, and a teardown window where authenable stayed writable after inetctlsockdestroy() had released the control socket.
Move the per-net SCTP sysctl registration into sctpctrlsockinit() after sctpctlsockinit() succeeds, and unregister the sysctl table before destroying the control socket in sctpctrlsockexit(). If sysctl registration fails after the control socket was created, destroy the control socket in the same init path.
Make sctpsysctlnetunregister() tolerate a missing header and clear the saved pointer so init-error and exit paths can safely share the unregister helper.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68162?
CVE-2026-68162 has a risk rating of 38, indicating a moderate severity.
What does CVE-2026-68162 affect?
CVE-2026-68162 affects the Linux kernel's SCTP (Stream Control Transmission Protocol) functionality.
How do I fix CVE-2026-68162?
To fix CVE-2026-68162, update your Linux kernel to the latest patched version where the vulnerability has been addressed.
When was CVE-2026-68162 published?
CVE-2026-68162 was published on August 10, 2026.
What is the nature of the vulnerability in CVE-2026-68162?
CVE-2026-68162 is a use-after-free (UAF) vulnerability that occurs during netns teardown related to SCTP authentication handling.