CVE-2026-72242 - Vulnerability Details

- selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

Description

In the Linux kernel, the following vulnerability has been resolved:

selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a
struct socket * to selinux_socket_bind() and
selinux_socket_connect_helper(). However, when the hook is invoked
from the ASCONF softirq path (sctp_process_asconf), there is no file
reference guaranteeing that sk->sk_socket is non-NULL. The setsockopt
callers (bindx, connectx, set_primary, sendmsg connect) hold a file
reference and are not affected.

Both selinux_socket_bind() and selinux_socket_connect_helper()
immediately resolve sock->sk, never using the struct socket * for
anything else. Refactor the inner logic into helpers that take a
struct sock * directly so that selinux_sctp_bind_connect() never needs
to touch sk->sk_socket at all.

Published: 2026-08-15

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability occurs in the SELinux SCTP bind and connect handling path. The code dereferences sk->sk_socket while processing an ASCONF softirq, but no file reference guarantees this pointer is non‑null. If a null pointer is accessed, the kernel can crash, leading to a denial of service. The weakness is a conventional null‑pointer dereference, indicated by CWE‑476.

Affected Systems

All Linux distributions that ship a kernel containing the unpatched selinux_sctp_bind_connect implementation are affected. The fix is incorporated in the kernel commit 37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb and any subsequent commit that removes the dereference.

Risk and Exploitability

Because the defect can trigger a kernel panic, the impact is significant for availability. The CVSS score is 7.5, the EPSS score is below 1%, and it is not listed in the KEV catalog, indicating a moderate exploitability with low probability. The likely attack vector involves sending a crafted SCTP packet that exercises the ASCONF path while SELinux is enabled. Given the lack of publicly reported exploitation, the risk is elevated but the probability of exploitation remains uncertain.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d452930fd3b9031e59abfeddb2fa383f1403d61a`	affected	< e4f3b8db1b0c5e9f6374b8996d9e1888d1042b55
`d452930fd3b9031e59abfeddb2fa383f1403d61a`	affected	< 2fcaf133a8fd88b69f32ebaecad93fd302da828f
`d452930fd3b9031e59abfeddb2fa383f1403d61a`	affected	< a4bc2fb8536488b37680c0b66c59434a4b7f8c2f
`d452930fd3b9031e59abfeddb2fa383f1403d61a`	affected	< 5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4
`d452930fd3b9031e59abfeddb2fa383f1403d61a`	affected	< cc8bd47b35eca82393cbad08b1cc86f02e034439
`d452930fd3b9031e59abfeddb2fa383f1403d61a`	affected	< d61a80b17254be7230bc5544f8e62ddf21ab38e2
`d452930fd3b9031e59abfeddb2fa383f1403d61a`	affected	< 37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb
`d452930fd3b9031e59abfeddb2fa383f1403d61a`	affected	< 56acfeb10019e200ab6787d01f8d7cbe0f01526f

Linux

affected

Version	Status	Constraints
`4.17`	affected	—
`0`	unaffected	< 4.17
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d452930fd3b9031e59abfeddb2fa383f1403d61a,5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4)`	affected	code_commit	—
`[d452930fd3b9031e59abfeddb2fa383f1403d61a,cc8bd47b35eca82393cbad08b1cc86f02e034439)`	affected	code_commit	—
`[d452930fd3b9031e59abfeddb2fa383f1403d61a,d61a80b17254be7230bc5544f8e62ddf21ab38e2)`	affected	code_commit	—
`[d452930fd3b9031e59abfeddb2fa383f1403d61a,37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb)`	affected	code_commit	—
`[d452930fd3b9031e59abfeddb2fa383f1403d61a,56acfeb10019e200ab6787d01f8d7cbe0f01526f)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.17`	affected	generic	—
`[0,4.17)`	unaffected	generic	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes commit 37d642b37ccdc31e or any later commit that removes the sk->sk_socket dereference.
If an immediate kernel upgrade is not possible, disable the SCTP protocol or remove SELinux policies that trigger the problematic hook to prevent the code path from executing.
Continuously monitor Linux kernel advisories for backports that address this null‑pointer dereference and schedule regular kernel update cycles to close the vulnerability.

Generated by OpenCVE AI on August 17, 2026 at 08:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00677.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2fcaf133a8fd88b69f32ebaecad93fd302da828f
https://git.kernel.org/stable/c/37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb
https://git.kernel.org/stable/c/56acfeb10019e200ab6787d01f8d7cbe0f01526f
https://git.kernel.org/stable/c/5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4
https://git.kernel.org/stable/c/a4bc2fb8536488b37680c0b66c59434a4b7f8c2f
https://git.kernel.org/stable/c/cc8bd47b35eca82393cbad08b1cc86f02e034439
https://git.kernel.org/stable/c/d61a80b17254be7230bc5544f8e62ddf21ab38e2
https://git.kernel.org/stable/c/e4f3b8db1b0c5e9f6374b8996d9e1888d1042b55
https://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-72242-a448@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72242
https://www.cve.org/CVERecord?id=CVE-2026-72242

History

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2fcaf133a8fd88b69f32ebaecad93fd302da828f https://git.kernel.org/stable/c/a4bc2fb8536488b37680c0b66c59434a4b7f8c2f https://git.kernel.org/stable/c/e4f3b8db1b0c5e9f6374b8996d9e1888d1042b55

Tue, 18 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-72242-a448@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72242 https://www.cve.org/CVERecord?id=CVE-2026-72242
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 09:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a struct socket * to selinux_socket_bind() and selinux_socket_connect_helper(). However, when the hook is invoked from the ASCONF softirq path (sctp_process_asconf), there is no file reference guaranteeing that sk->sk_socket is non-NULL. The setsockopt callers (bindx, connectx, set_primary, sendmsg connect) hold a file reference and are not affected. Both selinux_socket_bind() and selinux_socket_connect_helper() immediately resolve sock->sk, never using the struct socket * for anything else. Refactor the inner logic into helpers that take a struct sock * directly so that selinux_sctp_bind_connect() never needs to touch sk->sk_socket at all.
Title		selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb https://git.kernel.org/stable/c/56acfeb10019e200ab6787d01f8d7cbe0f01526f https://git.kernel.org/stable/c/5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4 https://git.kernel.org/stable/c/cc8bd47b35eca82393cbad08b1cc86f02e034439 https://git.kernel.org/stable/c/d61a80b17254be7230bc5544f8e62ddf21ab38e2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:54:30.378Z

Updated: 2026-08-23T12:47:05.827Z

Reserved: 2026-08-09T03:40:39.914Z

Link: CVE-2026-72242

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:51.317

Modified: 2026-08-23T13:16:42.200

Link: CVE-2026-72242

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72242 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-17T08:45:03Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object