In the Linux kernel, the following vulnerability has been resolved:
sctp: avoid auth_enable sysctl UAF during netns teardown
procsctpdoauth() updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl->data, so an already opened sysctl file can still target a network namespace while that namespace is being torn down.
SCTP previously registered its per-net sysctls from sctpdefaultsinit(), while the control socket is created later from sctpctrlsockinit(). This exposed a window during initialization where authenable was writable before net->sctp.ctlsock existed, and a teardown window where authenable stayed writable after inetctlsockdestroy() had released the control socket.
Move the per-net SCTP sysctl registration into sctpctrlsockinit() after sctpctlsockinit() succeeds, and unregister the sysctl table before destroying the control socket in sctpctrlsock_exit(). If sysctl registration fails after the control socket was created, destroy the control socket in the same init path.
Make sctpsysctlnet_unregister() tolerate a missing header and clear the saved pointer so init-error and exit paths can safely share the unregister helper.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68162.json",
"cna_assigner": "Linux"
}