CVE-2026-72383sctp: fix addr_wq_timer race in sctp_free_addr_wq()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: sctp: fix addr_wq_timer race in sctp_free_addr_wq() sctp_free_addr_wq() previously removed addr_wq_timer using timer_delete() while holding addr_wq_lock. However, timer_delete() does not guarantee that a currently running timer handler has completed. This allows a race with sctp_addr_wq_timeout_handler(), where the handler may still run after addr_waitq has been freed, acquire addr_wq_lock, and access freed memory, leading to a use-after-free. Fix this by calling timer_shutdown_sync() before taking addr_wq_lock. This guarantees that any in-flight timer handler has finished and prevents the timer from being re-armed during teardown, making subsequent cleanup safe.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4db67e808640e3934d82ce61ee8e2e89fd877ba8 before a8323fb2ab6cd6978f359daeed6688e0cadf32ba; from 4db67e808640e3934d82ce61ee8e2e89fd877ba8 before c3e5cac47519d77ad36b9c03a1df1536aaa0c4a1; from 4db67e808640e3934d82ce61ee8e2e89fd877ba8 before 976c19de0f22a857ba0112f39635f8fd7a257568 | CNA record |
References
- https://git.kernel.org/stable/c/a8323fb2ab6cd6978f359daeed6688e0cadf32ba
- https://git.kernel.org/stable/c/c3e5cac47519d77ad36b9c03a1df1536aaa0c4a1
- https://git.kernel.org/stable/c/976c19de0f22a857ba0112f39635f8fd7a257568
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.