CVE-2026-52917: Linux Kernel SCTP Diag Race Condition—Local Privilege Escalation & Memory Leak

Technical summary

CVE-2026-52917 is a use-after-free vulnerability in the Linux kernel's SCTP diagnostic subsystem, specifically in the dump_one path of the sock_diag interface. The vulnerability occurs due to a race condition between the exact socket diagnostic lookup (which holds a transport reference and calls lock_sock) and sctp_association_free(), which marks the association dead and frees its bind address list. After acquiring the lock, inet_diag_msg_sctpasoc_fill() and inet_assoc_attr_size() may attempt to dereference association state that is no longer valid. This can result in an out-of-bounds read when the bind-address list pointer is interpreted as a valid sctp_sockaddr_entry from unrelated memory. The fix implements a check to reject the association if it has been reaped or detached from the endpoint after lock acquisition, returning a stale lookup error to prevent formatting of corrupted association state.

Business impact

This vulnerability affects the availability and confidentiality of Linux systems running vulnerable kernel versions. An unprivileged local user can trigger a kernel crash (denial of service) or leak sensitive kernel memory without authentication. For organizations running Linux infrastructure—especially containerized environments, shared hosting platforms, or systems where unprivileged user access is common—this represents a direct threat to service continuity and data confidentiality. The attack requires only local access, making it exploitable by any user with a shell account.

Affected systems

The Linux kernel is affected across multiple versions. The vulnerability impacts systems using SCTP networking capabilities with the diagnostic (diag) module enabled. This includes enterprise Linux distributions (Red Hat Enterprise Linux, Ubuntu, Debian, CentOS) and any custom kernel builds that include SCTP diag functionality. Both 64-bit and 32-bit architectures are potentially affected. Verify the specific affected kernel versions in your Linux distribution's security advisory.

Exploitability

Exploitation requires local access and low privileges—any unprivileged user can trigger the race condition via the SCTP sock_diag interface. The attack does not require special kernel configuration or privileges beyond standard user-level access. The window for the race condition is tight but reproducible; a successful exploitation produces either a kernel panic (immediate detection) or silent memory disclosure (harder to detect). No public exploit code is known to be in active use at this time, but the relative simplicity of triggering the condition means exploitation is feasible for moderately skilled attackers.

Remediation

Apply kernel security updates provided by your Linux distribution. Verify the patched kernel version in your vendor's advisory and schedule a system reboot at an appropriate maintenance window. Interim mitigation is limited; disabling SCTP or the diag module via kernel parameters may reduce exposure if operationally feasible, but this is not a substitute for patching. Monitor system logs for kernel panics or diagnostic module errors that may indicate exploitation attempts.

Patch guidance

Obtain and apply the kernel update from your Linux distribution's security repository. Patched versions incorporate the fix to reject stale associations by checking if an association has been reaped or detached from the endpoint after lock acquisition. Verify against your vendor's security advisory for the exact patched kernel version numbers. After patching, a system reboot is required for the new kernel to take effect. Test in a non-production environment first if operational concerns exist.

Detection guidance

Monitor system logs (dmesg, /var/log/kern.log) for kernel panics, out-of-bounds access warnings, or SCTP-related errors that may indicate exploitation. Network-based detection is difficult since the attack uses local diagnostic interfaces. Endpoint detection and response (EDR) tools should monitor for unusual SCTP diagnostic socket operations from unprivileged processes. Consider kernel auditing rules to log access to netlink diagnostic sockets (AF_NETLINK with NETLINK_INET_DIAG). Kernel Address Sanitizer (KASAN) instrumented kernels will reliably detect the out-of-bounds read.

Why prioritize this

This vulnerability should be prioritized for urgent patching because it combines local exploitability (low barrier to entry), high severity impact (crash or memory leak), and affects a fundamental kernel subsystem. The CVSS 7.1 score reflects high impact to both confidentiality and availability. Organizations with diverse user bases, multi-tenant systems, or container orchestration platforms are at elevated risk. This is not a theoretical edge case—the race condition is inherent to the diagnostic interface design and reliable exploitation is plausible.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: Attack Vector Local (requires shell access), Attack Complexity Low (race condition is not difficult to trigger), Privileges Required Low (unprivileged user sufficient), User Interaction None, Scope Unchanged, Confidentiality High (kernel memory disclosure), Integrity None, Availability High (kernel crash). The absence of network exploitability and integrity impact prevents a critical rating, but the combination of reliable local DoS and memory leak warrants high priority in any patch schedule.

Frequently asked questions