CVE-2026-72447 sctp: hold socket lock when dumping endpoints in sctp_diag
A race condition in Linux kernel SCTP diagnostics allows local attackers to leak uninitialized memory to userspace.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72447?
CVE-2026-72447 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sctp: hold socket lock when dumping endpoints in sctp_diag
SCTP_DIAG endpoint dumping was traversing endpoint address lists without holding lock_sock(), while those lists could change concurrently via socket operations (e.g., bindx changes). This creates a race where nla_reserve() counts addresses under RCU protection, but the subsequent copy may see fewer entries, potentially leaking uninitialized memory to userspace.
Fix this by:
- Taking a reference on each endpoint during hash traversal - Moving socket operations (lock_sock()) outside read_lock_bh() - Serializing address list access during dump - Reworking sctp_for_each_endpoint() to support restart-based traversal with (net, pos) tracking
Also:
- Add WARN_ON_ONCE() for inconsistent address counts - Fix idiag_states filtering for LISTEN vs association cases - Skip dumping endpoints being freed (ep->base.dead) - Move dump position tracking into iterator, removing cb->args[4] and its comment for sctp_ep_dump()., - Update the comment for cb->args[4] and remove the comment for unused cb->args[5] for sctp_sock_dump().
Note: traversal is restart-based and may re-scan buckets multiple times, but this is acceptable due to small bucket sizes and required to support sleeping-safe callbacks.
This issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero Day Initiative.
Which versions are affected by CVE-2026-72447?
How do I fix CVE-2026-72447?
Apply the vendor's patch.
Is CVE-2026-72447 being exploited?
There is no known exploitation of CVE-2026-72447 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72447, DEBIAN-CVE-2026-72447, GHSA-p5mf-mjh6-46fm, UBUNTU-CVE-2026-72447.