CVE-2026-72383 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should be aware of this vulnerability and take necessary steps to assess and remediate it. Affected operators, platforms, vulnerability-management, and security teams should prioritize assessment and remediation of this use-after-free vulnerability.

Technical summary

The Linux kernel has a use-after-free vulnerability in the sctp_free_addr_wq function. The vulnerability is caused by a race condition between the sctp_free_addr_wq function and the sctp_addr_wq_timeout_handler function. This allows a use-after-free vulnerability in the sctp_free_addr_wq function. The issue has been resolved in the Linux kernel. Linux kernel maintainers and users should prioritize assessment and remediation of this use-after-free vulnerability. The vulnerability has been resolved by calling timer_shutdown_sync() before taking addr_wq_lock, guaranteeing that any in-flight timer handler has finished and preventing the timer from being re-armed during teardown.

Defensive priority

Linux kernel maintainers and users should prioritize assessment and remediation of this use-after-free vulnerability.

Recommended defensive actions

• Review Linux kernel version and assess applicability of the vulnerability
• Implement compensating controls, such as monitoring and exception tracking
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis of the Linux kernel source code and testing may be necessary to fully understand the issue. The vulnerability is caused by a race condition between the sctp_free_addr_wq function and the sctp_addr_wq_timeout_handler function. This allows a use-after-free vulnerability in the sctp_free_addr_wq function. Linux kernel maintainers and users should prioritize assessment and remediation of this use-after-free vulnerability. The vulnerability has been resolved in the Linux kernel.

Official resources