SCTP Vulnerability in Linux Kernel

CVE-2026-52917

What is CVE-2026-52917?

A vulnerability in the Linux kernel relates to the Stream Control Transmission Protocol (SCTP) where the socket diagnostic lookup can access stale associations. When an SCTP association is freed, the kernel may still attempt to dereference that association's state, potentially leading to an out-of-bounds read from unrelated memory regions. This bug can stem from improper handling of deleted associations and can disrupt the integrity of socket communication, elevating risks in data handling and system security. The issue has been mitigated by implementing checks to reject associations that are no longer valid.

References