{"cve":"CVE-2026-72447","nvd":{"published":"2026-08-15T06:22:18.600","modified":"2026-08-17T06:19:12.170","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: hold socket lock when dumping endpoints in sctp_diag\n\nSCTP_DIAG endpoint dumping was traversing endpoint address lists without\nholding lock_sock(), while those lists could change concurrently via\nsocket operations (e.g., bindx changes). This creates a race where\nnla_reserve() counts addresses under RCU protection, but the subsequent\ncopy may see fewer entries, potentially leaking uninitialized memory to\nuserspace.\n\nFix this by:\n\n- Taking a reference on each endpoint during hash traversal\n- Moving socket operations (lock_sock()) outside read_lock_bh()\n- Serializing address list access during dump\n- Reworking sctp_for_each_endpoint() to support restart-based traversal\n  with (net, pos) tracking\n\nAlso:\n\n- Add WARN_ON_ONCE() for inconsistent address counts\n- Fix idiag_states filtering for LISTEN vs association cases\n- Skip dumping endpoints being freed (ep->base.dead)\n- Move dump position tracking into iterator, removing cb->args[4] and\n  its comment for sctp_ep_dump().,\n- Update the comment for cb->args[4] and remove the comment for unused\n  cb->args[5] for sctp_sock_dump().\n\nNote: traversal is restart-based and may re-scan buckets multiple times,\nbut this is acceptable due to small bucket sizes and required to support\nsleeping-safe callbacks.\n\nThis issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero\nDay Initiative.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/207bb4ce8fe7de961ae7bb33569ad2cd61f44954","https://git.kernel.org/stable/c/722576aba0a6d9423714550b1c03239b0f0def77","https://git.kernel.org/stable/c/7d8297e26b4e20b5d1c3c3fe51fe81a1c7fbc823","https://git.kernel.org/stable/c/8b38e3dcfde3077dbc03eb8ef88e03cc19f70b8a","https://git.kernel.org/stable/c/abe7f8828e6ac8be858870c2bf836258844f97d5"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-72447","score":0.0022,"percentile":0.12569,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}