Race condition in Linux kernel - CVE-2026-72447

Vulnerability identifier: #VU142996

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-72447

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose uninitialized kernel memory to userspace.

The vulnerability exists due to a race condition in sctp_diag endpoint dumping when traversing endpoint address lists during diagnostic dumping without holding the socket lock. A local user can trigger concurrent socket operations while requesting SCTP diagnostic endpoint data to disclose uninitialized kernel memory to userspace.

The issue occurs because address counts gathered under RCU protection can become inconsistent before the subsequent copy operation.

Linux kernel
Ubuntu
linux-nvidia (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-azure (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia (Ubuntu package) - addressed in versions 5.15.0-1112.113, 5.15.0.1112.112
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux (Ubuntu package) - addressed in versions 7.0.0-38.38, 7.0.0-38.38.1, 7.0.0-1008.9, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14, 7.0.0-1015.15
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1015.15
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1017.17

• https://git.kernel.org/stable/c/207bb4ce8fe7de961ae7bb33569ad2cd61f44954
• https://git.kernel.org/stable/c/722576aba0a6d9423714550b1c03239b0f0def77
• https://git.kernel.org/stable/c/7d8297e26b4e20b5d1c3c3fe51fe81a1c7fbc823
• https://git.kernel.org/stable/c/8b38e3dcfde3077dbc03eb8ef88e03cc19f70b8a
• https://git.kernel.org/stable/c/abe7f8828e6ac8be858870c2bf836258844f97d5
• https://git.kernel.org/stable/c/ec3c2d59a192e17e1014ba71afc368ba162ecac3
• https://git.kernel.org/stable/c/f09a245f33e567b604efa1960b7a2d25dd9c8713
• https://git.kernel.org/stable/c/f98c294a9369b6fe89e652c06357ee594be4dfa2

• Race condition in Linux kernel sctp
• Ubuntu update for linux-gcp-7.0
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-azure-7.0
• Ubuntu update for linux
• Ubuntu update for linux-azure
• Ubuntu update for linux-oem-7.0