CVE-2026-68161

A flaw was found in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. When a network namespace (netns) is torn down, the associated SCTP UDP (User Datagram Protocol) tunnel sockets are not properly closed. This oversight can lead to a resource leak, potentially resulting in a denial of service (DoS) condition due to resource exhaustion or unexpected behavior during subsequent system calls.

A MODERATE impact flaw was found in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2. When a network namespace that has SCTP UDP tunneling enabled (through the net.sctp.udp_port sysctl) is torn down, the per-namespace SCTP UDP tunnel sockets are not closed, leaking kernel resources. A local user with the privileges required to configure the sysctl and to create and destroy network namespaces could repeatedly do so to exhaust resources, resulting in a denial of service. Fixes are being pursued by the delegated engineering teams for the affected RHEL kernel and kernel-rt update streams and the Red Hat In-Vehicle OS streams. Red Hat Enterprise Linux 6 and 7 ELS kernels and the RHEL 8.4 kernel and kernel-rt streams are not affected because the vulnerable code is not present in those builds; certain older delegated kernel-rt update streams have been marked won't fix. The CVE.org record scores this flaw 9.8 CRITICAL assuming a network-based, unauthenticated attack vector; Red Hat's CVSS 3.1 score of 7.0 reflects that exploitation requires local access with privileges to configure SCTP UDP tunneling and manage network namespaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

SCTP UDP tunneling can be disabled by leaving the net.sctp.udp_port sysctl unset or setting it to 0. Per-network-namespace SCTP UDP tunnel sockets are only created when net.sctp.udp_port is configured to a non-zero port, and changing the sysctl value stops the existing tunnel sockets, so namespaces torn down afterwards no longer leak them. This workaround disables SCTP-over-UDP encapsulation and is not suitable for environments that require it; such environments have no workaround other than upgrading to a fixed kernel.