---
id: CVE-2026-68162
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sctp: avoid auth_enable sysctl UAF during netns teardown

  proc_sctp_do_auth() updates the SCTP control socket after changing
  net.sctp.auth_enable
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sctp: avoid auth_enable sysctl UAF during netns teardown

  proc_sctp_do_auth() updates the SCTP control socket after changing
  net.sctp.auth_enable. The handler gets the …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-10'
updated: '2026-08-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68162'
references:
  - url: 'https://git.kernel.org/stable/c/158f3cc332dc53f43ec20060233d7c3cecd6d912'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/626bda8cfe43dff19a9833ff6ba055a817b5455c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/66700c0719675e0e118ae83b2d7168dacd69dd3d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a50e73488e0bbdd262b3be3c9a1d8dd078382381'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/be6aae9d1b91c603adb35872d37d40e83daf8758'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ceb7190b5c873d4a1267a1600c5aa52c600e929f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f8d5e7846025f4ab15a461235f8ebae9094a361a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fd66854a22661929245f3d2b244c432bc8b1a150'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68162.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-68162'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2513314'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-68162'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68162'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026081004-CVE-2026-68162-086a@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00184
epssPercentile: 0.07007
ingestedAt: '2026-08-23T13:48:06.446Z'
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
cwe:
  - CWE-825
scores:
  nvd: 7.8
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sctp: avoid auth_enable sysctl UAF during netns teardown

proc_sctp_do_auth() updates the SCTP control socket after changing
net.sctp.auth_enable. The handler gets the per-net SCTP state from
ctl->data, so an already opened sysctl file can still target a network
namespace while that namespace is being torn down.

SCTP previously registered its per-net sysctls from sctp_defaults_init(),
while the control socket is created later from sctp_ctrlsock_init(). This
exposed a window during initialization where auth_enable was writable
before net->sctp.ctl_sock existed, and a teardown window where auth_enable
stayed writable after inet_ctl_sock_destroy() had released the control
socket.

Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after
sctp_ctl_sock_init() succeeds, and unregister the sysctl table before
destroying the control socket in sctp_ctrlsock_exit(). If sysctl
registration fails after the control socket was created, destroy the
control socket in the same init path.

Make sctp_sysctl_net_unregister() tolerate a missing header and clear the
saved pointer so init-error and exit paths can safely share the unregister
helper.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-12 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68162.json)