PT-2026-51710 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-52917

NVD

In the Linux kernel, the following vulnerability has been resolved:

sctp: diag: reject stale associations in dump one path

The SCTP exact sock diag lookup can hold a transport reference, block on lock sock(sk), and then resume after sctp association free() has marked the association dead and freed its bind address list.

When that happens, inet assoc attr size() and inet diag msg sctpasoc fill() can still dereference association state that is no longer valid for reporting. In particular, inet diag msg sctpasoc fill() may read an empty bind-address list as a real sctp sockaddr entry and trigger an out-of-bounds read from unrelated association memory.

Reject the association after taking the socket lock if it has been reaped or detached from the endpoint, and report the lookup as stale. This keeps the exact dump-one path from formatting torn association state.

Related Identifiers

CVE-2026-52917

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-52917 · Security Note
• https://git.kernel.org/stable/c/b2be72d401833194917e44fbd8d8144bb4f2db16 · Note
• https://git.kernel.org/stable/c/6657af827e21883ae90693e42e7f59a6aab690b5 · Note
• https://git.kernel.org/stable/c/480f754580b5686b928977d16a59f20cef83ff01 · Note
• https://git.kernel.org/stable/c/78c4f964b2f94e405721c093773f6250e1e676b2 · Note
• https://git.kernel.org/stable/c/e97c2a535e23ed0fdd2660993fb3f10d9535c9bc · Note
• https://git.kernel.org/stable/c/5425de8bd6e9fe5bd67d158e3348171ae7510117 · Note
• https://git.kernel.org/stable/c/f5af203dec6e0e7a6090fcc2130e9f3901bfc84d · Note
• https://git.kernel.org/stable/c/5eba3e48d78edd7551b992cb7ba687019b3a78da · Note