CVE-2026-52917

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: diag: reject stale associations in dump_one path<br /> <br /> The SCTP exact sock_diag lookup can hold a transport reference, block on<br /> lock_sock(sk), and then resume after sctp_association_free() has marked<br /> the association dead and freed its bind address list.<br /> <br /> When that happens, inet_assoc_attr_size() and<br /> inet_diag_msg_sctpasoc_fill() can still dereference association state<br /> that is no longer valid for reporting. In particular,<br /> inet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a<br /> real sctp_sockaddr_entry and trigger an out-of-bounds read from<br /> unrelated association memory.<br /> <br /> Reject the association after taking the socket lock if it has been<br /> reaped or detached from the endpoint, and report the lookup as stale.<br /> This keeps the exact dump-one path from formatting torn association<br /> state.