CVE-2026-72383

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A race condition exists in the sctp_free_addr_wq() function during the cleanup of network address work queues. This allows a timer handler to access memory that has already been freed, leading to a use-after-free vulnerability. Such a vulnerability can cause system instability, including crashes, and potentially lead to denial of service.

A race in SCTP addr_wq_timer teardown can leave sctp_addr_wq_timeout_handler running after sctp_free_addr_wq has started freeing addr_waitq entries. Because timer_delete does not wait for an in-flight timer callback to finish, the callback may later take addr_wq_lock and access freed queue memory, resulting in a use-after-free. For the CVSS the PR:L is used because a local user or local process is needed to create the SCTP and namespace teardown conditions in typical deployments. The issue is not directly network reachable because packet traffic alone does not normally free the per-net SCTP address wait queue. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel use-after-free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.