From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D96133CB2E0 for ; Mon, 10 Aug 2026 12:03:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786363439; cv=none; b=iBKQ85lZTuOu3FcOPTpfPjFuSOh0kAPu8DI/f26d+jv6w0J+ZdVLz8sT9Bv7Ptv/IoJ7LgNnXCmwie5w+bFuZ+HnnPrI1UYW0rMdL9D3ytSTxBkqhAAS6ZicGr4RVBYYKVISBZgS8RJsp+CIkY0wA+2Q61/4Yd2uE+zGcR2eLbU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786363439; c=relaxed/simple; bh=wh4lORrPnqhu6qyprN+5kuEjxWMlycBqwG8JGhPmGKk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nOlTUP/yweAy0chmEnTpaxUeIedg8pggmRE/IZAAh7YrD03A4MrgdEEPV3nFyqpvmdv4OM6KbIt1iogGCO/us5361544OA3ijcptjHPyICMAFNJrQrZ5bBS8RnIHZswhVWLD9kxlzaetldDVaiXh1uxVxIxSNUx3cvbmvysBRek= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Pbmcvxpb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Pbmcvxpb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 993FA1F00A3D; Mon, 10 Aug 2026 12:03:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786363429; bh=cBGNGXk3YB4I3X/Tl23yl9TsbxzfhDCM7f/99f5QZis=; h=From:To:Cc:Subject:Date:Reply-To; b=PbmcvxpbEi8GAgNmvxjrwArPZsempAF1cxHPkxqI0deKzJmsBwSIEHsV9BdG0M1OM sD3WKG0of6hrbm2jBre5Tu4p084bCxful5xsHYO7j6rb2faWIh1djI0Iyd7ZV/sGMS +MahC73I+8GncfHZTNrrLIDBFbT4V7e3AgtReAIQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown Date: Mon, 10 Aug 2026 13:57:58 +0200 Message-ID: <2026081004-CVE-2026-68161-d9d6@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2990; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=u4LuTMr7b/xgTLIdtYSIzjqnlm1ggvar55JqvQQGPnU=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmVeyZc0JJjS0k/qMmyLer4m47ombr3fm/N1mD4eIqVu cDwme2ZjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjI/CaGWUwcD/ea+Hv8tYgI tNGfkbNyinb4b4b5FZs1fxY1bn2pf/c1x9IryZsuz3CRBwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown proc_sctp_do_udp_port() starts per-net SCTP UDP tunneling sockets when net.sctp.udp_port is set, and stops/restarts them when the sysctl value changes. The netns exit path does not stop these sockets, so a namespace can be torn down while its SCTP UDP tunnel sockets are still installed. Close the UDP tunnel sockets from sctp_ctrlsock_exit() after unregistering the per-net sysctl table. This prevents new sysctl writes from racing in while the sockets are being released, and closes the sockets before the control socket is destroyed. The Linux kernel CVE team has assigned CVE-2026-68161 to this issue. Affected and fixed versions =========================== Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 6.6.151 with commit c6eb2d615210b80339548ab07c0230edaab9a6c7 Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 6.12.101 with commit 8ff78591d309c50a4fdab683b68dd8d512a270dd Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 6.18.42 with commit 3bf0e349cbb4f975f35eb22753acc346b89c66a0 Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 7.1.6 with commit 37ff9794be48d0caa37687e04d09675f9c849121 Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 7.2-rc5 with commit ffb2bd7ade36ec4da32c46a6eddbf4515316d08c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-68161 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/sctp/protocol.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c6eb2d615210b80339548ab07c0230edaab9a6c7 https://git.kernel.org/stable/c/8ff78591d309c50a4fdab683b68dd8d512a270dd https://git.kernel.org/stable/c/3bf0e349cbb4f975f35eb22753acc346b89c66a0 https://git.kernel.org/stable/c/37ff9794be48d0caa37687e04d09675f9c849121 https://git.kernel.org/stable/c/ffb2bd7ade36ec4da32c46a6eddbf4515316d08c