PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-52917 Linux CVE debrief

CVE-2026-52917 is a HIGH-severity vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. The vulnerability occurs in the diag (diagnostic) component, specifically in the dump_one path, where stale associations can be incorrectly reported. This happens when the exact sock_diag lookup holds a transport reference, blocks on lock_sock(sk), and then resumes after the association has been marked dead and freed. As a result, the reporting can still dereference association state that is no longer valid, potentially leading to out-of-bounds reads from unrelated memory. To mitigate this, the association should be rejected after taking the socket lock if it has been reaped or detached from the endpoint, and the lookup should be reported as stale.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-24
Original CVE updated
2026-07-08
Advisory published
2026-06-24
Advisory updated
2026-07-08

Who should care

System administrators and security teams responsible for Linux kernel-based systems, especially those using SCTP, should be aware of this vulnerability. Given its HIGH CVSS score of 7.1, priority should be given to patching or mitigating this vulnerability to prevent potential exploitation.

Technical summary

The vulnerability is located in the Linux kernel's SCTP diag component. The SCTP exact sock_diag lookup can hold a transport reference and block on lock_sock(sk). If the association is freed while the lookup is blocked, subsequent resumption can lead to dereferencing of invalid association state. Specifically, inet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a real sctp_sockaddr_entry, triggering an out-of-bounds read. The fix involves rejecting stale associations after taking the socket lock and reporting the lookup as stale.

Defensive priority

High priority should be given to patching this vulnerability due to its HIGH CVSS severity score. Linux kernel maintainers and distributors should expedite the patching process for affected systems.

Recommended defensive actions

  • Apply the official patch from the Linux kernel maintainers as soon as possible.
  • Review system configurations and ensure that SCTP is properly configured and secured.
  • Monitor system logs for any suspicious activity related to SCTP.
  • Consider implementing compensating controls, such as network segmentation or access controls, to limit the potential impact of exploitation.
  • Perform thorough vulnerability scanning and inventory checks to identify affected systems.

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. Additional source references from the Linux kernel Git repository offer technical insights into the vulnerability and its fix.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-52917 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-52917

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-52917 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-52917

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/480f754580b5686b928977d16a59f20cef83ff01

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5425de8bd6e9fe5bd67d158e3348171ae7510117

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5eba3e48d78edd7551b992cb7ba687019b3a78da

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6657af827e21883ae90693e42e7f59a6aab690b5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/78c4f964b2f94e405721c093773f6250e1e676b2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b2be72d401833194917e44fbd8d8144bb4f2db16

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e97c2a535e23ed0fdd2660993fb3f10d9535c9bc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.