CVE-2026-72398 sctp: add INIT verification after cookie unpacking

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

CVE-2026-72398 sctp: add INIT verification after cookie unpacking

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

EUVD-2026-59282

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

CVE-2026-72383 sctp: fix addr_wq_timer race in sctp_free_addr_wq()

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

CVE-2026-72383

In the Linux kernel SCTP subsystem, CVE-2026-72383 describes a race in sctp_free_addr_wq() where addr_wq_timer could be re-entered after addr_wq_lock is held, allowing a sctp_addr_wq_timeout_handler() to access freed memory (use-after-free). The vulnerability is mitigated by calling timer_shutdow...

CVE-2026-72383 sctp: fix addr_wq_timer race in sctp_free_addr_wq()

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

EUVD-2026-59141

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sksocket dereference in selinuxsctpbindconnect selinuxsctpbindconnect dereferences sk-sksocket to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is invoked from the...

CVE-2026-72242

The CVE-2026-72242 issue affects the Linux kernel SELinux SCTP path: selinux_sctp_bind_connect() dereferenced sk->sk_socket to pass a struct socket* to selinux_socket_bind() and selinux_socket_connect_helper(), but during ASCONF softirq (sctp_process_asconf) there is no guaranteed non-NULL sk-...

CVE-2026-72242 selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sksocket dereference in selinuxsctpbindconnect selinuxsctpbindconnect dereferences sk-sksocket to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is invoked from the...

CVE-2026-72242 selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sksocket dereference in selinuxsctpbindconnect selinuxsctpbindconnect dereferences sk-sksocket to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is invoked from the...

EUVD-2026-58979

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-72021 ipvs: use parsed transport offset in SCTP state lookup

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-72021

Summary: The CVE-2026-72021 issue affects the Linux kernel’s IPVS SCTP state lookup. The kernel incorrectly read the SCTP chunk header using a wrong offset for IPv6 when extension headers were present, causing misclassification of handshake steps (e.g., INIT1 vs ESTABLISHED) and incorrect managem...

CVE-2026-72021 ipvs: use parsed transport offset in SCTP state lookup

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

PT-2026-72601

In the Linux kernel, the following vulnerability has been resolved: sctp: fix err chunk memory leaks in INIT handling When sctp verify init encounters unrecognized parameters, it allocates an err chunk to report them. However, this chunk is leaked in several code paths: 1. In sctp sf do 5 1B init...

Linux Distros Unpatched Vulnerability : CVE-2026-72413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: fix errchunk memory leaks in INIT handling When sctpverifyinit encounters unrecognized parameters, it allocates an errchunk to report them. However, this...

PT-2026-72430

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk socket dereference in selinux sctp bind connect selinux sctp bind connect dereferences sk-sk socket to pass a struct socket to selinux socket bind and selinux socket connect helper. However, when the hook is...

Linux Distros Unpatched Vulnerability : CVE-2026-72398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried i...

PT-2026-72571

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addr wq timer race in sctp free addr wq sctp free addr wq previously removed addr wq timer using timer delete while holding addr wq lock. However, timer delete does not guarantee that a currently running timer handler h...

Linux Distros Unpatched Vulnerability : CVE-2026-74469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th...