CVE-2026-52917

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SCTP sock diag lookup process where the system can hold a transport reference and block on the lock sock(sk) function. If the process resumes after sctp association free() has marked the association as dead and freed its bind address list, the functions inet assoc attr size() and inet diag msg sctpasoc fill() may dereference invalid association state. Specifically, inet diag msg sctpasoc fill() might interpret an empty bind-address list as a valid sctp sockaddr entry, leading to an out-of-bounds read from unrelated association memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.