Skip to main content

Linux Kernel CVE-2026-72383

| EUVDEUVD-2026-59282 HIGH
2026-08-15 Linux GHSA-8hr4-pprj-6g53
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition exploitation requires precise timing across CPUs, warranting AC:H over the official AC:L; all other metrics align with official assessment.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:59 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix addr_wq_timer race in sctp_free_addr_wq()

sctp_free_addr_wq() previously removed addr_wq_timer using timer_delete() while holding addr_wq_lock. However, timer_delete() does not guarantee that a currently running timer handler has completed.

This allows a race with sctp_addr_wq_timeout_handler(), where the handler may still run after addr_waitq has been freed, acquire addr_wq_lock, and access freed memory, leading to a use-after-free.

Fix this by calling timer_shutdown_sync() before taking addr_wq_lock. This guarantees that any in-flight timer handler has finished and prevents the timer from being re-armed during teardown, making subsequent cleanup safe.

AnalysisAI

Use-after-free in the Linux kernel SCTP subsystem allows a local low-privileged attacker to potentially achieve full kernel compromise (confidentiality, integrity, and availability impact rated High) by triggering a race condition during SCTP address workqueue teardown. The race occurs because sctp_free_addr_wq() previously used timer_delete(), which does not wait for an in-flight timer handler to complete, permitting sctp_addr_wq_timeout_handler() to acquire addr_wq_lock and dereference already-freed memory. No public exploit code has been identified and EPSS is low at 0.21% (11th percentile), but kernel UAF primitives have historically been weaponized into privilege escalation; three backport fixes have been merged into multiple stable kernel branches.

Technical ContextAI

The vulnerability resides in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically the address workqueue management in net/sctp/socket.c or equivalent subsystem files. The affected code path governs how SCTP cleans up its internal address wait queue (addr_wq) and its associated kernel timer (addr_wq_timer). The root-cause class is a classic kernel concurrency defect: timer_delete() cancels the timer's pending state but provides no synchronization guarantee if the timer callback (sctp_addr_wq_timeout_handler) is already executing on another CPU. By contrast, timer_shutdown_sync() - the fix - blocks until any running handler finishes and prevents re-arming, making subsequent memory teardown safe. This is a temporal memory-safety flaw (use-after-free) rather than a logic flaw. The CPE data (cpe:2.3:a:linux:linux) and commit range indicate the vulnerable code was introduced at commit 4db67e808640e3934d82ce61ee8e2e89fd877ba8 and spans kernels from version 3.7 through recent stable branches prior to the fixes. No CWE was formally assigned, but the pattern maps to CWE-416 (Use After Free) driven by CWE-362 (Race Condition).

RemediationAI

The primary remediation is to upgrade to a patched kernel version: Linux 6.18.40 or later in the 6.18 stable series, Linux 7.1.5 or later in the 7.1 stable series, or Linux 7.2-rc2 or later in the mainline series. Distribution maintainers should apply the relevant upstream stable commit (a8323fb, c3e5cac, or 976c19d) to their kernel packages; refer to https://git.kernel.org/stable/ for the full patch context. If immediate kernel upgrade is not feasible, the primary compensating control is to restrict SCTP module loading: echo 'install sctp /bin/false' >> /etc/modprobe.d/sctp-disable.conf && modprobe -r sctp will prevent the SCTP subsystem from being loaded, eliminating the attack surface entirely. The trade-off is loss of SCTP-based services (used in telephony/SS7 stacks, some clustering software); verify SCTP is not required before applying this workaround. On systems where SCTP must remain available, restricting local code execution via mandatory access control (SELinux, AppArmor confinement of untrusted processes) reduces but does not eliminate exposure, since the flaw requires only PR:L.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72383 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy