CVE-2026-68161

Summary

In the Linux kernel, the following vulnerability has been resolved:

sctp: close UDP tunnel sockets during netns teardown

proc_sctp_do_udp_port() starts per-net SCTP UDP tunneling sockets when net.sctp.udp_port is set, and stops/restarts them when the sysctl value changes. The netns exit path does not stop these sockets, so a namespace can be torn down while its SCTP UDP tunnel sockets are still installed.

Close the UDP tunnel sockets from sctp_ctrlsock_exit() after unregistering the per-net sysctl table. This prevents new sysctl writes from racing in while the sockets are being released, and closes the sockets before the control socket is destroyed.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux046c052b475e7119b6a30e3483e2888fc606a2f8 < c6eb2d615210b80339548ab07c0230edaab9a6c7affected
LinuxLinux046c052b475e7119b6a30e3483e2888fc606a2f8 < 8ff78591d309c50a4fdab683b68dd8d512a270ddaffected
LinuxLinux046c052b475e7119b6a30e3483e2888fc606a2f8 < 3bf0e349cbb4f975f35eb22753acc346b89c66a0affected
LinuxLinux046c052b475e7119b6a30e3483e2888fc606a2f8 < 37ff9794be48d0caa37687e04d09675f9c849121affected
LinuxLinux046c052b475e7119b6a30e3483e2888fc606a2f8 < ffb2bd7ade36ec4da32c46a6eddbf4515316d08caffected
LinuxLinux5.11affected
LinuxLinux0 < 5.11unaffected
LinuxLinux6.6.151 <= 6.6.*unaffected
LinuxLinux6.12.101 <= 6.12.*unaffected
LinuxLinux6.18.42 <= 6.18.*unaffected
LinuxLinux7.1.6 <= 7.1.*unaffected
LinuxLinux7.2-rc5 <= *unaffected

Weaknesses

References