Skip to main content

Linux Kernel EUVDEUVD-2026-38720

| CVE-2026-52917 HIGH
Out-of-bounds Read (CWE-125)
2026-06-24 Linux GHSA-fcw9-vwjp-9j4v
Buffer Overflow Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
6.3 MEDIUM

Local sock_diag access (AV:L, PR:L), a narrow teardown race raises AC:H; OOB kernel read gives C:H and likely panic gives A:H, with no integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 10:34 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.1 (HIGH)
Patch available
Jun 24, 2026 - 09:16 EUVD
CVE Published
Jun 24, 2026 - 07:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 07:14 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sctp: diag: reject stale associations in dump_one path

The SCTP exact sock_diag lookup can hold a transport reference, block on lock_sock(sk), and then resume after sctp_association_free() has marked the association dead and freed its bind address list.

When that happens, inet_assoc_attr_size() and inet_diag_msg_sctpasoc_fill() can still dereference association state that is no longer valid for reporting. In particular, inet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a real sctp_sockaddr_entry and trigger an out-of-bounds read from unrelated association memory.

Reject the association after taking the socket lock if it has been reaped or detached from the endpoint, and report the lookup as stale. This keeps the exact dump-one path from formatting torn association state.

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel's SCTP sock_diag subsystem allows a local attacker to disclose adjacent kernel memory and potentially crash the system by racing a diag dump against association teardown. The exact sock_diag lookup (dump_one path) can hold a transport reference, block on lock_sock(), and resume after sctp_association_free() has reaped the association and freed its bind-address list, causing inet_diag_msg_sctpasoc_fill() to dereference an emptied bind-address list as a valid sctp_sockaddr_entry. CVSS is 7.1 (local, high confidentiality and availability impact); EPSS is low (0.18%, 7th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The flaw lives in the kernel's sock_diag/inet_diag infrastructure as applied to SCTP (Stream Control Transmission Protocol) associations, queried via the NETLINK_SOCK_DIAG interface used by tools such as ss. The vulnerable code is the SCTP exact (dump-one) diag lookup, which acquires a transport reference and then blocks on lock_sock(sk); during that blocking window sctp_association_free() can mark the association dead and free its bind-address list. When the lookup resumes, inet_assoc_attr_size() and inet_diag_msg_sctpasoc_fill() compute sizes and serialize fields from association state that is no longer valid - reading an empty bind-address list head as if it were a real sctp_sockaddr_entry, walking off the end of freed/unrelated memory. The root cause is a use-after-free / time-of-check-to-time-of-use race producing an out-of-bounds read (CWE-416/CWE-125 class; the input CWE is N/A and the 'Buffer Overflow' tag is an approximation - this is an OOB read, not a write). The fix rejects associations that have been reaped or detached from the endpoint after the socket lock is taken and reports the lookup as stale.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 (or later) on the matching branch, applied via your distribution's kernel update channel. The fix is the stable commit series referenced at git.kernel.org (e.g. https://git.kernel.org/stable/c/6657af827e21883ae90693e42e7f59a6aab690b5 and https://git.kernel.org/stable/c/b2be72d401833194917e44fbd8d8144bb4f2db16); track downstream advisories from your distro. If immediate patching is not possible, the practical compensating control is to restrict who can issue SCTP sock_diag queries: the lookup is reached through NETLINK_SOCK_DIAG, so limiting CAP_NET_ADMIN and removing untrusted local users' ability to run diagnostic tooling reduces exposure, and where SCTP is unused you can prevent the sctp module from loading (e.g. blacklist sctp / install sctp /bin/true), which eliminates the affected code path entirely - the trade-off being loss of SCTP functionality for any application that needs it. These mitigations only narrow local access; the kernel update is the real fix.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38720 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy