CVE-2026-68162

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: avoid auth_enable sysctl UAF during netns teardown<br /> <br /> proc_sctp_do_auth() updates the SCTP control socket after changing<br /> net.sctp.auth_enable. The handler gets the per-net SCTP state from<br /> ctl-&gt;data, so an already opened sysctl file can still target a network<br /> namespace while that namespace is being torn down.<br /> <br /> SCTP previously registered its per-net sysctls from sctp_defaults_init(),<br /> while the control socket is created later from sctp_ctrlsock_init(). This<br /> exposed a window during initialization where auth_enable was writable<br /> before net-&gt;sctp.ctl_sock existed, and a teardown window where auth_enable<br /> stayed writable after inet_ctl_sock_destroy() had released the control<br /> socket.<br /> <br /> Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after<br /> sctp_ctl_sock_init() succeeds, and unregister the sysctl table before<br /> destroying the control socket in sctp_ctrlsock_exit(). If sysctl<br /> registration fails after the control socket was created, destroy the<br /> control socket in the same init path.<br /> <br /> Make sctp_sysctl_net_unregister() tolerate a missing header and clear the<br /> saved pointer so init-error and exit paths can safely share the unregister<br /> helper.