CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a
struct socket * to selinux_socket_bind() and
selinux_socket_connect_helper().  However, when the hook is invoked
from the ASCONF softirq path (sctp_process_asconf), there is no file
reference guaranteeing that sk->sk_socket is non-NULL.  The setsockopt
callers (bindx, connectx, set_primary, sendmsg connect) hold a file
reference and are not affected.

Both selinux_socket_bind() and selinux_socket_connect_helper()
immediately resolve sock->sk, never using the struct socket * for
anything else.  Refactor the inner logic into helpers that take a
struct sock * directly so that selinux_sctp_bind_connect() never needs
to touch sk->sk_socket at all.

The Linux kernel CVE team has assigned CVE-2026-72242 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.17 with commit d452930fd3b9031e59abfeddb2fa383f1403d61a and fixed in 6.6.148 with commit 5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4
	Issue introduced in 4.17 with commit d452930fd3b9031e59abfeddb2fa383f1403d61a and fixed in 6.12.97 with commit cc8bd47b35eca82393cbad08b1cc86f02e034439
	Issue introduced in 4.17 with commit d452930fd3b9031e59abfeddb2fa383f1403d61a and fixed in 6.18.40 with commit d61a80b17254be7230bc5544f8e62ddf21ab38e2
	Issue introduced in 4.17 with commit d452930fd3b9031e59abfeddb2fa383f1403d61a and fixed in 7.1.5 with commit 37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb
	Issue introduced in 4.17 with commit d452930fd3b9031e59abfeddb2fa383f1403d61a and fixed in 7.2-rc3 with commit 56acfeb10019e200ab6787d01f8d7cbe0f01526f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72242
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	security/selinux/hooks.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4
	https://git.kernel.org/stable/c/cc8bd47b35eca82393cbad08b1cc86f02e034439
	https://git.kernel.org/stable/c/d61a80b17254be7230bc5544f8e62ddf21ab38e2
	https://git.kernel.org/stable/c/37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb
	https://git.kernel.org/stable/c/56acfeb10019e200ab6787d01f8d7cbe0f01526f