CVE-2026-72242

A flaw was found in the Linux kernel's SELinux module. When handling Stream Control Transmission Protocol (SCTP) connections, a specific function attempts to access a network socket that may not exist. This can lead to a system crash, resulting in a Denial of Service (DoS) for affected systems.

This vulnerability is rated as Moderate impact because triggering the flaw results in a kernel crash and denial of service without permitting privilege escalation or information disclosure. The issue arises during Stream Control Transmission Protocol (SCTP) address reconfiguration chunk processing when SELinux hooks evaluate socket permissions in softirq context lacking a valid socket reference. Systems are only exposed if SELinux is active and SCTP networking is utilized by running services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.