CVE-2026-72447

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the SCTP DIAG endpoint dumping process. The system traverses endpoint address lists without holding the lock sock() lock, while these lists can be modified concurrently by socket operations such as bindx. This allows a scenario where nla reserve() counts addresses under RCU (Read-Copy-Update) protection, but the subsequent copy operation finds fewer entries, which may lead to the leakage of uninitialized memory to userspace. The issue involves the sctp for each endpoint() function and the sctp ep dump() and sctp sock dump() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.