CVE-2026-72383

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the SCTP implementation. The function sctp free addr wq() previously used timer delete() to remove the addr wq timer while holding the addr wq lock. Because timer delete() does not guarantee that a currently running timer handler has completed, a race occurs with sctp addr wq timeout handler(). This allows the handler to execute after addr waitq has been freed, acquire the addr wq lock, and access freed memory, resulting in a use-after-free condition.

Recommendations Update the Linux kernel to a version where timer shutdown sync() is called before taking the addr wq lock in the sctp free addr wq() function.