CVE-2026-72447

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) diagnostic (SCTP_DIAG) endpoint dumping mechanism. A race condition occurs when address lists are traversed without holding the necessary socket lock, allowing concurrent modifications. A local attacker could exploit this to potentially leak uninitialized memory from the kernel to userspace, leading to information disclosure.

SCTP_DIAG endpoint dumping can race with socket address list updates such as bindx because endpoint address lists were read without lock_sock(). The race can make the netlink dump reserve space for one address count and then copy fewer entries, which can expose uninitialized kernel memory to local userspace. For the CVSS the PR:L is used because triggering requires a local process able to issue SCTP_DIAG netlink requests and race them with socket operations, but full administrator privileges are not required in common configurations. The issue is not directly network reachable because it is triggered through local diagnostic netlink control plane operations rather than remote SCTP packets. Impact is primarily confidentiality loss from a local information leak. Availability impact is limited but possible if inconsistent state triggers warnings or repeated failed dumps.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.