CVE-2026-68162: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68162 Overview

CVE-2026-68162 is a use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. The flaw resides in proc_sctp_do_auth(), which updates the SCTP control socket when net.sctp.auth_enable changes. The handler retrieves per-net SCTP state from ctl->data, allowing an already-opened sysctl file to reference a network namespace during teardown. The vulnerability exposes two race windows: writes to auth_enable before net->sctp.ctl_sock exists during initialization, and writes after inet_ctl_sock_destroy() has released the control socket during teardown.

Critical Impact
A local attacker holding an open file descriptor to the auth_enable sysctl can trigger a use-after-free on the SCTP control socket during network namespace teardown, enabling potential local privilege escalation.

Affected Products

Linux kernel SCTP subsystem (upstream)
Distributions shipping affected Linux kernel builds with SCTP enabled
Systems using network namespaces with SCTP sysctls exposed

Discovery Timeline

2026-08-10 - CVE-2026-68162 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68162

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] triggered by improper ordering of sysctl registration and control socket lifecycle in SCTP. When a user opens /proc/sys/net/sctp/auth_enable, the sysctl handler stores a pointer to per-net SCTP state in ctl->data. A subsequent write invokes proc_sctp_do_auth(), which dereferences state that may reference a freed control socket.

SCTP registered its per-net sysctls in sctp_defaults_init(), but the control socket was created later in sctp_ctrlsock_init(). This ordering created a window where auth_enable could be written before net->sctp.ctl_sock existed. A symmetric window existed on teardown, where the sysctl remained writable after inet_ctl_sock_destroy() released the control socket.

The attack requires local access with permission to open the sysctl file, and typically requires CAP_NET_ADMIN within a user namespace to manipulate SCTP settings. Exploitation targets the freed control socket for memory reuse leading to privilege escalation.

Root Cause

The root cause is a lifecycle mismatch between the SCTP per-net sysctl table and the SCTP control socket. Sysctl registration occurred before the control socket existed and persisted after its destruction, allowing proc_sctp_do_auth() to operate on a dangling reference.

Attack Vector

An attacker opens the auth_enable sysctl file in a network namespace, retaining the file descriptor while the namespace is torn down. Writes issued through the retained descriptor after control socket destruction dereference freed memory, producing a use-after-free condition exploitable for local privilege escalation. The technical fix is documented in the Kernel Git Commit 19573dc and related stable backports.

// No verified proof-of-concept available.
// Refer to upstream commits for the exact code paths and fix logic.

Detection Methods for CVE-2026-68162

Indicators of Compromise

Kernel oops or panic entries referencing proc_sctp_do_auth, sctp_ctrlsock_exit, or inet_ctl_sock_destroy in dmesg and /var/log/kern.log.
KASAN reports flagging use-after-free reads or writes within the SCTP control socket allocation slab.
Unexpected process termination or privilege changes correlated with writes to /proc/sys/net/sctp/auth_enable.

Detection Strategies

Enable KASAN (CONFIG_KASAN=y) on test kernels to surface use-after-free access in the SCTP subsystem.
Audit processes that hold long-lived file descriptors to files under /proc/sys/net/sctp/ across network namespace lifecycle changes.
Monitor for unprivileged user namespace creation followed by SCTP sysctl access, a common precondition for local kernel exploitation.

Monitoring Recommendations

Ingest kernel ring buffer logs into a centralized logging platform and alert on SCTP-related warnings and oops signatures.
Track unshare(CLONE_NEWNET|CLONE_NEWUSER) and subsequent SCTP sysctl writes via auditd or eBPF-based telemetry.
Correlate namespace teardown events with process file-descriptor tables to identify retained sysctl handles.

How to Mitigate CVE-2026-68162

Immediate Actions Required

Apply the upstream kernel patches referenced in the Kernel Git Commit 19573dc and companion commits, or update to a distribution kernel that includes the fixes.
Restrict unprivileged user namespace creation on multi-tenant hosts where SCTP is not required.
Inventory systems with CONFIG_IP_SCTP enabled and prioritize patching those with untrusted local users.

Patch Information

The fix moves per-net SCTP sysctl registration into sctp_ctrlsock_init() after sctp_ctl_sock_init() succeeds and unregisters the sysctl table before destroying the control socket in sctp_ctrlsock_exit(). If sysctl registration fails after control socket creation, the control socket is destroyed in the same init path. sctp_sysctl_net_unregister() now tolerates a missing header and clears the saved pointer. Relevant commits: 19573dc, 626bda8, 66700c0, a50e734, be6aae9, and f8d5e78.

Workarounds

Blacklist the SCTP kernel module on systems that do not require it to remove the vulnerable sysctl entirely.
Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where feature parity permits.
Restrict access to /proc/sys/net/sctp/auth_enable via mount namespace or LSM policy on multi-tenant hosts.

bash

# Disable the SCTP module if unused
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null

# Restrict unprivileged user namespaces (Debian/Ubuntu)
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo "kernel.unprivileged_userns_clone=0" | sudo tee /etc/sysctl.d/99-userns.conf