CVE-2026-72021 Linux CVE debrief

Who should care

Linux kernel users, administrators, and security teams should be aware of this vulnerability and take necessary actions to mitigate it. They should review and apply patches, monitor for suspicious SCTP traffic, and implement compensating controls to detect and prevent exploitation. Additionally, they should verify the integrity of their systems, review system logs for potential exploitation attempts, and ensure that their security teams are informed and prepared to respond to potential incidents. This includes assessing the vulnerability's impact on their specific environments, identifying potential attack vectors, and developing incident response plans. Furthermore, they should consider implementing additional security measures, such as network segmentation, access controls, and intrusion detection systems, to reduce the attack surface and improve overall security posture. Linux kernel developers and maintainers should also review the code changes and patches to ensure that the fixes are properly implemented and do not introduce new vulnerabilities. They should also consider providing additional guidance and support to users and administrators to help them understand and mitigate the vulnerability effectively. Finally, security researchers and analysts should continue to monitor the vulnerability and provide updates on its exploitation and mitigation, as well as develop and share tools and techniques for detecting and preventing exploitation. The vulnerability's impact on the Linux kernel and its users highlights the importance of continued investment in security research, development, and testing to ensure the stability and security of critical infrastructure. By taking these steps, Linux kernel users, administrators, and security teams can help mitigate the vulnerability and reduce the risk of exploitation. They should also stay informed about the latest developments and updates related to the vulnerability and be prepared to adapt their security strategies as needed. Overall, a comprehensive and coordinated approach is necessary to effectively address the vulnerability and ensure the security of Linux kernel-based systems. This includes collaboration between

Technical summary

The Linux kernel has a vulnerability in the IPVS SCTP state table. The set_sctp_state() function reads the SCTP chunk header again to drive the IPVS SCTP state table. However, for IPv6 packets, it computes the offset incorrectly, leading to the state machine reading from the wrong offset for IPv6 SCTP packets with extension headers. This causes the connection to move from NONE to ESTABLISHED instead of INIT1, resulting in incorrect timeout and active/inactive destination counters updates.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to fix the vulnerability
• Monitor for suspicious SCTP traffic
• Implement compensating controls to detect and prevent exploitation
• Verify the integrity of system logs to detect potential exploitation attempts
• Implement network segmentation to reduce the attack surface
• Develop and test incident response plans specific to this vulnerability
• Conduct a thorough review of system configurations to ensure secure settings

Evidence notes

The vulnerability exists in the Linux kernel's IPVS SCTP state table. The set_sctp_state() function reads the SCTP chunk header again to drive the IPVS SCTP state table. However, for IPv6 packets, it computes the offset incorrectly, leading to the state machine reading from the wrong offset for IPv6 SCTP packets with extension headers.

Official resources