Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-72242

selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.266, 5.15.217, 6.1.184, 6.6.148, 6.12.97, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a struct socket * to selinux_socket_bind() and selinux_socket_connect_helper(). However, when the hook is invoked from the ASCONF softirq path (sctp_process_asconf), there is no file reference guaranteeing that sk->sk_socket is non-NULL. The setsockopt callers (bindx, connectx, set_primary, sendmsg connect) hold a file reference and are not affected. Both selinux_socket_bind() and selinux_socket_connect_helper() immediately resolve sock->sk, never using the struct socket * for anything else. Refactor the inner logic into helpers that take a struct sock * directly so that selinux_sctp_bind_connect() never needs to touch sk->sk_socket at all.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From d452930fd3b9031e59abfeddb2fa383f1403d61a · fixed in e4f3b8db1b0c5e9f6374b8996d9e1888d1042b55; From d452930fd3b9031e59abfeddb2fa383f1403d61a · fixed in 2fcaf133a8fd88b69f32ebaecad93fd302da828f; From d452930fd3b9031e59abfeddb2fa383f1403d61a · fixed in a4bc2fb8536488b37680c0b66c59434a4b7f8c2f; From d452930fd3b9031e59abfeddb2fa383f1403d61a · fixed in 5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4; From d452930fd3b9031e59abfeddb2fa383f1403d61a · fixed in cc8bd47b35eca82393cbad08b1cc86f02e034439; From d452930fd3b9031e59abfeddb2fa383f1403d61a · fixed in d61a80b17254be7230bc5544f8e62ddf21ab38e2; From d452930fd3b9031e59abfeddb2fa383f1403d61a · fixed in 37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb; From d452930fd3b9031e59abfeddb2fa383f1403d61a · fixed in 56acfeb10019e200ab6787d01f8d7cbe0f01526f

  • Linux Linux

    4.17

  • KernelLinux

    From 4.17.0 · fixed in 5.10.266; From 5.11.0 · fixed in 5.15.217; From 5.16.0 · fixed in 6.1.184; From 6.2.0 · fixed in 6.6.148; From 6.7.0 · fixed in 6.12.97; From 6.13.0 · fixed in 6.18.40; From 6.19.0 · fixed in 7.1.5

References 8

git.kernel.org