Linux Kernel CVE-2026-72242

The flaw resides in the Linux kernel SELinux LSM (Linux Security Module) subsystem, specifically in selinux_sctp_bind_connect(), which is invoked as a hook during SCTP socket bind and connect operations. SCTP (Stream Control Transmission Protocol) supports dynamic address reconfiguration via ASCONF (Association Configuration Change) chunks processed in the softirq bottom-half context through sctp_process_asconf(). In this interrupt-driven path, no file descriptor holds a reference to the socket, meaning sk->sk_socket may be NULL. The function unconditionally dereferences sk->sk_socket to pass a struct socket * to selinux_socket_bind() and selinux_socket_connect_helper(), both of which immediately resolve back to sock->sk and never use the struct socket * for anything else. Setsockopt-based callers (bindx, connectx, set_primary, sendmsg connect) hold a file reference and are unaffected. No formal CWE is assigned, but the root cause class is CWE-476 (NULL Pointer Dereference): a pointer is used without verifying liveness in all call contexts. The fix refactors the inner helpers to accept struct sock * directly, eliminating the sk_socket dereference entirely. Affected kernel range begins at commit d452930fd3b9031e59abfeddb2fa383f1403d61a (Linux 4.17).