CVE-2026-68162 (GCVE-0-2026-68162)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-23 12:46
VLAI
Title
sctp: avoid auth_enable sysctl UAF during netns teardown
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: avoid auth_enable sysctl UAF during netns teardown proc_sctp_do_auth() updates the SCTP control socket after changing net.sctp.auth_enable. The handler gets the per-net SCTP state from ctl->data, so an already opened sysctl file can still target a network namespace while that namespace is being torn down. SCTP previously registered its per-net sysctls from sctp_defaults_init(), while the control socket is created later from sctp_ctrlsock_init(). This exposed a window during initialization where auth_enable was writable before net->sctp.ctl_sock existed, and a teardown window where auth_enable stayed writable after inet_ctl_sock_destroy() had released the control socket. Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after sctp_ctl_sock_init() succeeds, and unregister the sysctl table before destroying the control socket in sctp_ctrlsock_exit(). If sysctl registration fails after the control socket was created, destroy the control socket in the same init path. Make sctp_sysctl_net_unregister() tolerate a missing header and clear the saved pointer so init-error and exit paths can safely share the unregister helper.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 10c869a52f266e40f548cc3c565d14930a5edafc , < 19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4 (git)
Affected: dc583e7e5f8515ca489c0df28e4362a70eade382 , < ceb7190b5c873d4a1267a1600c5aa52c600e929f (git)
Affected: bd2a2939423566c654545fa3e96a656662a0af9e , < fd66854a22661929245f3d2b244c432bc8b1a150 (git)
Affected: 1b67030d39f2b00f94ac1f0af11ba6657589e4d3 , < 158f3cc332dc53f43ec20060233d7c3cecd6d912 (git)
Affected: 7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6 , < 66700c0719675e0e118ae83b2d7168dacd69dd3d (git)
Affected: c184bc621e3cef03ac9ba81a50dda2dae6a21d36 , < 626bda8cfe43dff19a9833ff6ba055a817b5455c (git)
Affected: 15649fd5415eda664ef35780c2013adeb5d9c695 , < be6aae9d1b91c603adb35872d37d40e83daf8758 (git)
Affected: 15649fd5415eda664ef35780c2013adeb5d9c695 , < a50e73488e0bbdd262b3be3c9a1d8dd078382381 (git)
Affected: 15649fd5415eda664ef35780c2013adeb5d9c695 , < f8d5e7846025f4ab15a461235f8ebae9094a361a (git)
Affected: 5.4.290 , < 5.4.292 (semver)
Affected: 5.10.234 , < 5.10.266 (semver)
Affected: 5.15.177 , < 5.15.217 (semver)
Affected: 6.1.125 , < 6.1.184 (semver)
Affected: 6.6.72 , < 6.6.151 (semver)
Affected: 6.12.10 , < 6.12.101 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 5.4.292 , ≤ 5.4.* (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/protocol.c",
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4",
              "status": "affected",
              "version": "10c869a52f266e40f548cc3c565d14930a5edafc",
              "versionType": "git"
            },
            {
              "lessThan": "ceb7190b5c873d4a1267a1600c5aa52c600e929f",
              "status": "affected",
              "version": "dc583e7e5f8515ca489c0df28e4362a70eade382",
              "versionType": "git"
            },
            {
              "lessThan": "fd66854a22661929245f3d2b244c432bc8b1a150",
              "status": "affected",
              "version": "bd2a2939423566c654545fa3e96a656662a0af9e",
              "versionType": "git"
            },
            {
              "lessThan": "158f3cc332dc53f43ec20060233d7c3cecd6d912",
              "status": "affected",
              "version": "1b67030d39f2b00f94ac1f0af11ba6657589e4d3",
              "versionType": "git"
            },
            {
              "lessThan": "66700c0719675e0e118ae83b2d7168dacd69dd3d",
              "status": "affected",
              "version": "7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6",
              "versionType": "git"
            },
            {
              "lessThan": "626bda8cfe43dff19a9833ff6ba055a817b5455c",
              "status": "affected",
              "version": "c184bc621e3cef03ac9ba81a50dda2dae6a21d36",
              "versionType": "git"
            },
            {
              "lessThan": "be6aae9d1b91c603adb35872d37d40e83daf8758",
              "status": "affected",
              "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
              "versionType": "git"
            },
            {
              "lessThan": "a50e73488e0bbdd262b3be3c9a1d8dd078382381",
              "status": "affected",
              "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
              "versionType": "git"
            },
            {
              "lessThan": "f8d5e7846025f4ab15a461235f8ebae9094a361a",
              "status": "affected",
              "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.292",
              "status": "affected",
              "version": "5.4.290",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.266",
              "status": "affected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.217",
              "status": "affected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.184",
              "status": "affected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.151",
              "status": "affected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.101",
              "status": "affected",
              "version": "6.12.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/protocol.c",
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "5.4.290",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.10.234",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.15.177",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.1.125",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.6.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.12.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid auth_enable sysctl UAF during netns teardown\n\nproc_sctp_do_auth() updates the SCTP control socket after changing\nnet.sctp.auth_enable. The handler gets the per-net SCTP state from\nctl-\u003edata, so an already opened sysctl file can still target a network\nnamespace while that namespace is being torn down.\n\nSCTP previously registered its per-net sysctls from sctp_defaults_init(),\nwhile the control socket is created later from sctp_ctrlsock_init(). This\nexposed a window during initialization where auth_enable was writable\nbefore net-\u003esctp.ctl_sock existed, and a teardown window where auth_enable\nstayed writable after inet_ctl_sock_destroy() had released the control\nsocket.\n\nMove the per-net SCTP sysctl registration into sctp_ctrlsock_init() after\nsctp_ctl_sock_init() succeeds, and unregister the sysctl table before\ndestroying the control socket in sctp_ctrlsock_exit(). If sysctl\nregistration fails after the control socket was created, destroy the\ncontrol socket in the same init path.\n\nMake sctp_sysctl_net_unregister() tolerate a missing header and clear the\nsaved pointer so init-error and exit paths can safely share the unregister\nhelper."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered only by writing the per-net sysctl net.sctp.auth_enable via /proc/sys (proc_sctp_do_auth); it is not reachable from SCTP packet receive, sockets, or other remote protocol paths.\nAC:L - An attacker can open the sysctl file, concurrently destroy the target network namespace, and repeatedly write during teardown; pernet exit destroys ctl_sock before unregistering sysctls, and the attacker controls both sides of that race.\nPR:L - Exploitation requires writing a mode 0644 sysctl in a network namespace; an unprivileged host user with CAP_NET_ADMIN via user namespaces can create a netns, become namespace root, and write net/sctp/auth_enable without init-namespace privileges.\nUI:N - No victim interaction is required beyond the attacker opening the sysctl and triggering namespace teardown in their own threads or processes.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same host/kernel security domain; it does not cross VM, container, or IOMMU boundaries by itself.\nC:H - proc_sctp_do_auth dereferences net-\u003esctp.ctl_sock after inet_ctl_sock_destroy; lock_sock and sctp_sk(sk)-\u003eep access freed socket/endpoint memory, a use-after-free that can disclose or infer heap contents.\nI:H - On a successful write, the handler sets sctp_sk(sk)-\u003eep-\u003eauth_enable on a freed endpoint object, giving a controlled heap write primitive that can be developed into arbitrary kernel modification or code execution.\nA:H - Use-after-free on the SCTP control socket/endpoint during sysctl processing can cause kernel oops/panic from lock_sock or ep access on freed memory, even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:01.222Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ceb7190b5c873d4a1267a1600c5aa52c600e929f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd66854a22661929245f3d2b244c432bc8b1a150"
        },
        {
          "url": "https://git.kernel.org/stable/c/158f3cc332dc53f43ec20060233d7c3cecd6d912"
        },
        {
          "url": "https://git.kernel.org/stable/c/66700c0719675e0e118ae83b2d7168dacd69dd3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/626bda8cfe43dff19a9833ff6ba055a817b5455c"
        },
        {
          "url": "https://git.kernel.org/stable/c/be6aae9d1b91c603adb35872d37d40e83daf8758"
        },
        {
          "url": "https://git.kernel.org/stable/c/a50e73488e0bbdd262b3be3c9a1d8dd078382381"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8d5e7846025f4ab15a461235f8ebae9094a361a"
        }
      ],
      "title": "sctp: avoid auth_enable sysctl UAF during netns teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68162",
    "datePublished": "2026-08-10T11:59:29.099Z",
    "dateReserved": "2026-07-30T09:28:09.372Z",
    "dateUpdated": "2026-08-23T12:46:01.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68162",
      "date": "2026-09-20",
      "epss": "0.00184",
      "percentile": "0.08209"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:48:21.000Z",
      "cve": "CVE-2026-68162",
      "id": "msrc_CVE-2026-68162",
      "initial_release_date": "2026-08-11T01:16:25.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "sctp: avoid auth_enable sysctl UAF during netns teardown",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-68162.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sctp/protocol.c",
                  "net/sctp/sysctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4",
                    "status": "affected",
                    "version": "10c869a52f266e40f548cc3c565d14930a5edafc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ceb7190b5c873d4a1267a1600c5aa52c600e929f",
                    "status": "affected",
                    "version": "dc583e7e5f8515ca489c0df28e4362a70eade382",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd66854a22661929245f3d2b244c432bc8b1a150",
                    "status": "affected",
                    "version": "bd2a2939423566c654545fa3e96a656662a0af9e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "158f3cc332dc53f43ec20060233d7c3cecd6d912",
                    "status": "affected",
                    "version": "1b67030d39f2b00f94ac1f0af11ba6657589e4d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "66700c0719675e0e118ae83b2d7168dacd69dd3d",
                    "status": "affected",
                    "version": "7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "626bda8cfe43dff19a9833ff6ba055a817b5455c",
                    "status": "affected",
                    "version": "c184bc621e3cef03ac9ba81a50dda2dae6a21d36",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "be6aae9d1b91c603adb35872d37d40e83daf8758",
                    "status": "affected",
                    "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a50e73488e0bbdd262b3be3c9a1d8dd078382381",
                    "status": "affected",
                    "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f8d5e7846025f4ab15a461235f8ebae9094a361a",
                    "status": "affected",
                    "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.4.292",
                    "status": "affected",
                    "version": "5.4.290",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.10.266",
                    "status": "affected",
                    "version": "5.10.234",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.217",
                    "status": "affected",
                    "version": "5.15.177",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.184",
                    "status": "affected",
                    "version": "6.1.125",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.151",
                    "status": "affected",
                    "version": "6.6.72",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.101",
                    "status": "affected",
                    "version": "6.12.10",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sctp/protocol.c",
                  "net/sctp/sysctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.13"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.292",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.266",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.217",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid auth_enable sysctl UAF during netns teardown\n\nproc_sctp_do_auth() updates the SCTP control socket after changing\nnet.sctp.auth_enable. The handler gets the per-net SCTP state from\nctl-\u003edata, so an already opened sysctl file can still target a network\nnamespace while that namespace is being torn down.\n\nSCTP previously registered its per-net sysctls from sctp_defaults_init(),\nwhile the control socket is created later from sctp_ctrlsock_init(). This\nexposed a window during initialization where auth_enable was writable\nbefore net-\u003esctp.ctl_sock existed, and a teardown window where auth_enable\nstayed writable after inet_ctl_sock_destroy() had released the control\nsocket.\n\nMove the per-net SCTP sysctl registration into sctp_ctrlsock_init() after\nsctp_ctl_sock_init() succeeds, and unregister the sysctl table before\ndestroying the control socket in sctp_ctrlsock_exit(). If sysctl\nregistration fails after the control socket was created, destroy the\ncontrol socket in the same init path.\n\nMake sctp_sysctl_net_unregister() tolerate a missing header and clear the\nsaved pointer so init-error and exit paths can safely share the unregister\nhelper."
          }
        ],
        "id": "CVE-2026-68162",
        "lastModified": "2026-08-23T13:16:34.493",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:02.570",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/158f3cc332dc53f43ec20060233d7c3cecd6d912"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/626bda8cfe43dff19a9833ff6ba055a817b5455c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/66700c0719675e0e118ae83b2d7168dacd69dd3d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a50e73488e0bbdd262b3be3c9a1d8dd078382381"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/be6aae9d1b91c603adb35872d37d40e83daf8758"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ceb7190b5c873d4a1267a1600c5aa52c600e929f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f8d5e7846025f4ab15a461235f8ebae9094a361a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fd66854a22661929245f3d2b244c432bc8b1a150"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-12T10:03:14+00:00",
      "cve": "CVE-2026-68162",
      "id": "CVE-2026-68162",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sctp: avoid auth_enable sysctl UAF during netns teardown",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68162.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:34:54Z",
      "cve": "CVE-2026-68162",
      "id": "CVE-2026-68162",
      "initial_release_date": "2026-08-13T16:24:00Z",
      "product_status:known_affected": "727",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68162",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68162.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.