Linux Kernel EUVD-2026-59282

Exploitation requires a local user account with sufficient privilege to load or interact with the SCTP kernel module (PR:L - standard unprivileged user on most Linux distributions). The SCTP module must be present and loadable; systems with SCTP explicitly blocklisted via modprobe (a non-default configuration on most distributions) are not exposed. The vulnerability manifests only during SCTP subsystem teardown while an addr_wq timer handler is concurrently executing, meaning the attacker must be able to trigger this code path, which typically requires the ability to create SCTP sockets. Exploitation is limited by the inherent timing requirement of winning a kernel race condition across concurrent CPU execution, which reduces but does not eliminate practical exploitability. No network exposure is present - the flaw is entirely local (AV:L). Virtualized or containerized environments where the host kernel is shared among multiple tenants face elevated risk, since any tenant with access to a shell and SCTP capability could potentially escalate to host-kernel privileges.

The official CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects worst-case kernel compromise for a locally-accessible attacker with standard user privileges. However, the AC:L assignment appears optimistic: reliably winning a kernel timer race typically demands precise timing control, repeated attempts, or side-channel assistance - real-world exploitation complexity is higher than AC:L implies. EPSS at 0.21% (11th percentile) confirms the vulnerability is not being widely or actively exploited at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. These signals together indicate this is a genuine security flaw with meaningful local privilege-escalation potential, but not an active mass-exploitation threat. The high C/I/A impact should not be dismissed - UAF primitives in the kernel have a well-established history of enabling root escalation - but patching priority should be modulated against deployment exposure (containerized multi-tenant environments face higher risk than single-user workstations). No conflicting data signals were observed; the primary uncertainty is exact affected version boundaries, which are inferred from the EUVD commit range rather than an official NVD CPE version list.

A local user with standard shell access on an affected Linux system loads or utilizes the SCTP subsystem, then deliberately triggers rapid teardown of the SCTP address workqueue while the kernel timer handler is simultaneously executing on a second CPU core. By repeatedly forcing this timing window - for example through scripted SCTP socket creation and destruction - the attacker causes sctp_addr_wq_timeout_handler() to dereference the freed addr_wq structure, achieving a controlled use-after-free that can be leveraged with kernel heap-grooming techniques to overwrite function pointers or security-sensitive structures and escalate to root. No public proof-of-concept exploit is known at the time of analysis, making reliable weaponization dependent on attacker skill in kernel exploitation.