CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown

Published Aug 10, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

sctp: avoid authenable sysctl UAF during netns teardown

procsctpdoauth() updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl->data, so an already opened sysctl file can still target a network namespace while that namespace is being torn down.

SCTP previously registered its per-net sysctls from sctpdefaultsinit(), while the control socket is created later from sctpctrlsockinit(). This exposed a window during initialization where authenable was writable before net->sctp.ctlsock existed, and a teardown window where authenable stayed writable after inetctlsockdestroy() had released the control socket.

Move the per-net SCTP sysctl registration into sctpctrlsockinit() after sctpctlsockinit() succeeds, and unregister the sysctl table before destroying the control socket in sctpctrlsockexit(). If sysctl registration fails after the control socket was created, destroy the control socket in the same init path.

Make sctpsysctlnetunregister() tolerate a missing header and clear the saved pointer so init-error and exit paths can safely share the unregister helper.

Affected Software

1 affected component
Linux Linux kernel

Event History

Aug 10, 2026
CVE Published
via MITRE·11:59 AM
Data Sourced
via MITRE·11:59 AM
Description
Data Sourced
via NVD·01:20 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-68162?

CVE-2026-68162 has a risk rating of 38, indicating a moderate severity.

2

What does CVE-2026-68162 affect?

CVE-2026-68162 affects the Linux kernel's SCTP (Stream Control Transmission Protocol) functionality.

3

How do I fix CVE-2026-68162?

To fix CVE-2026-68162, update your Linux kernel to the latest patched version where the vulnerability has been addressed.

4

When was CVE-2026-68162 published?

CVE-2026-68162 was published on August 10, 2026.

5

What is the nature of the vulnerability in CVE-2026-68162?

CVE-2026-68162 is a use-after-free (UAF) vulnerability that occurs during netns teardown related to SCTP authentication handling.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203