CVE-2026-52917

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52917", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.367Z", "datePublished": "2026-06-24T07:14:13.886Z", "dateUpdated": "2026-10-19T19:37:00.367Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:39.095Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: diag: reject stale associations in dump_one path\n\nThe SCTP exact sock_diag lookup can hold a transport reference, block on\nlock_sock(sk), and then resume after sctp_association_free() has marked\nthe association dead and freed its bind address list.\n\nWhen that happens, inet_assoc_attr_size() and\ninet_diag_msg_sctpasoc_fill() can still dereference association state\nthat is no longer valid for reporting. In particular,\ninet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a\nreal sctp_sockaddr_entry and trigger an out-of-bounds read from\nunrelated association memory.\n\nReject the association after taking the socket lock if it has been\nreaped or detached from the endpoint, and report the lookup as stale.\nThis keeps the exact dump-one path from formatting torn association\nstate."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through a local NETLINK_SOCK_DIAG SOCK_DIAG_BY_FAMILY exact SCTP diagnostic request, not directly by received SCTP packets. A remote peer may help create SCTP state, but the stale-state formatter is invoked by a local netlink caller.\nAC:L - The race is between an exact diag lookup blocking on lock_sock() and association teardown, and a local attacker can create/tear down SCTP associations while issuing concurrent diag requests. Because the attacker controls both sides of the race, this is low complexity.\nPR:L - NETLINK_SOCK_DIAG read requests are accepted from non-root users, and the SCTP diag path only uses CAP_NET_ADMIN to gate extra reporting details. The attacker needs only basic local unprivileged execution.\nUI:N - No victim action is required once the attacker can run local code. The attacker can create SCTP sockets, race teardown, and issue the diagnostic query directly.\nS:U - The issue affects kernel SCTP diagnostic handling within the same host kernel security authority. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The stale association can cause an out-of-bounds read from unrelated association memory and return data through the netlink diagnostic response. Following the higher-severity rule for kernel OOB reads, this is treated as high confidentiality impact.\nI:N - The investigated path formats and returns stale association state but does not write through attacker-controlled stale pointers. I found no direct modification primitive or control-flow corruption path.\nA:H - The diag code continues dereferencing torn association and transport state after teardown, which can produce invalid stale-pointer reads and kernel oops conditions. Repeated local triggering can therefore cause high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/diag.c"], "versions": [{"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "6657af827e21883ae90693e42e7f59a6aab690b5", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "b2be72d401833194917e44fbd8d8144bb4f2db16", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "5425de8bd6e9fe5bd67d158e3348171ae7510117", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "e97c2a535e23ed0fdd2660993fb3f10d9535c9bc", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "480f754580b5686b928977d16a59f20cef83ff01", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "78c4f964b2f94e405721c093773f6250e1e676b2", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "f5af203dec6e0e7a6090fcc2130e9f3901bfc84d", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "5eba3e48d78edd7551b992cb7ba687019b3a78da", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/diag.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.12.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6657af827e21883ae90693e42e7f59a6aab690b5"}, {"url": "https://git.kernel.org/stable/c/b2be72d401833194917e44fbd8d8144bb4f2db16"}, {"url": "https://git.kernel.org/stable/c/5425de8bd6e9fe5bd67d158e3348171ae7510117"}, {"url": "https://git.kernel.org/stable/c/e97c2a535e23ed0fdd2660993fb3f10d9535c9bc"}, {"url": "https://git.kernel.org/stable/c/480f754580b5686b928977d16a59f20cef83ff01"}, {"url": "https://git.kernel.org/stable/c/78c4f964b2f94e405721c093773f6250e1e676b2"}, {"url": "https://git.kernel.org/stable/c/f5af203dec6e0e7a6090fcc2130e9f3901bfc84d"}, {"url": "https://git.kernel.org/stable/c/5eba3e48d78edd7551b992cb7ba687019b3a78da"}], "title": "sctp: diag: reject stale associations in dump_one path", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:21:48.089Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52917", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:22:37.939111Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:37:00.367Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:21:48.089Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52917", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:22:37.939111Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:22:38.516Z"}}], "cna": {"title": "sctp: diag: reject stale associations in dump_one path", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through a local NETLINK_SOCK_DIAG SOCK_DIAG_BY_FAMILY exact SCTP diagnostic request, not directly by received SCTP packets. A remote peer may help create SCTP state, but the stale-state formatter is invoked by a local netlink caller.\nAC:L - The race is between an exact diag lookup blocking on lock_sock() and association teardown, and a local attacker can create/tear down SCTP associations while issuing concurrent diag requests. Because the attacker controls both sides of the race, this is low complexity.\nPR:L - NETLINK_SOCK_DIAG read requests are accepted from non-root users, and the SCTP diag path only uses CAP_NET_ADMIN to gate extra reporting details. The attacker needs only basic local unprivileged execution.\nUI:N - No victim action is required once the attacker can run local code. The attacker can create SCTP sockets, race teardown, and issue the diagnostic query directly.\nS:U - The issue affects kernel SCTP diagnostic handling within the same host kernel security authority. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The stale association can cause an out-of-bounds read from unrelated association memory and return data through the netlink diagnostic response. Following the higher-severity rule for kernel OOB reads, this is treated as high confidentiality impact.\nI:N - The investigated path formats and returns stale association state but does not write through attacker-controlled stale pointers. I found no direct modification primitive or control-flow corruption path.\nA:H - The diag code continues dereferencing torn association and transport state after teardown, which can produce invalid stale-pointer reads and kernel oops conditions. Repeated local triggering can therefore cause high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "6657af827e21883ae90693e42e7f59a6aab690b5", "versionType": "git"}, {"status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "b2be72d401833194917e44fbd8d8144bb4f2db16", "versionType": "git"}, {"status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "5425de8bd6e9fe5bd67d158e3348171ae7510117", "versionType": "git"}, {"status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "e97c2a535e23ed0fdd2660993fb3f10d9535c9bc", "versionType": "git"}, {"status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "480f754580b5686b928977d16a59f20cef83ff01", "versionType": "git"}, {"status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "78c4f964b2f94e405721c093773f6250e1e676b2", "versionType": "git"}, {"status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "f5af203dec6e0e7a6090fcc2130e9f3901bfc84d", "versionType": "git"}, {"status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "5eba3e48d78edd7551b992cb7ba687019b3a78da", "versionType": "git"}], "programFiles": ["net/sctp/diag.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"status": "unaffected", "version": "0", "lessThan": "4.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.94", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.36", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.13", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sctp/diag.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6657af827e21883ae90693e42e7f59a6aab690b5"}, {"url": "https://git.kernel.org/stable/c/b2be72d401833194917e44fbd8d8144bb4f2db16"}, {"url": "https://git.kernel.org/stable/c/5425de8bd6e9fe5bd67d158e3348171ae7510117"}, {"url": "https://git.kernel.org/stable/c/e97c2a535e23ed0fdd2660993fb3f10d9535c9bc"}, {"url": "https://git.kernel.org/stable/c/480f754580b5686b928977d16a59f20cef83ff01"}, {"url": "https://git.kernel.org/stable/c/78c4f964b2f94e405721c093773f6250e1e676b2"}, {"url": "https://git.kernel.org/stable/c/f5af203dec6e0e7a6090fcc2130e9f3901bfc84d"}, {"url": "https://git.kernel.org/stable/c/5eba3e48d78edd7551b992cb7ba687019b3a78da"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: diag: reject stale associations in dump_one path\n\nThe SCTP exact sock_diag lookup can hold a transport reference, block on\nlock_sock(sk), and then resume after sctp_association_free() has marked\nthe association dead and freed its bind address list.\n\nWhen that happens, inet_assoc_attr_size() and\ninet_diag_msg_sctpasoc_fill() can still dereference association state\nthat is no longer valid for reporting. In particular,\ninet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a\nreal sctp_sockaddr_entry and trigger an out-of-bounds read from\nunrelated association memory.\n\nReject the association after taking the socket lock if it has been\nreaped or detached from the endpoint, and report the lookup as stale.\nThis keeps the exact dump-one path from formatting torn association\nstate."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.259", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.210", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.176", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.143", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.94", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.36", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.13", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "4.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:39.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52917", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:37:00.367Z", "dateReserved": "2026-06-09T07:44:35.367Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-24T07:14:13.886Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sctp/diag.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6657af827e21883ae90693e42e7f59a6aab690b5", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "b2be72d401833194917e44fbd8d8144bb4f2db16", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "5425de8bd6e9fe5bd67d158e3348171ae7510117", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "e97c2a535e23ed0fdd2660993fb3f10d9535c9bc", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "480f754580b5686b928977d16a59f20cef83ff01", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "78c4f964b2f94e405721c093773f6250e1e676b2", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "f5af203dec6e0e7a6090fcc2130e9f3901bfc84d", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "5eba3e48d78edd7551b992cb7ba687019b3a78da", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sctp/diag.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.94", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.36", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FA30F1C-F514-4A35-83AD-10A879443A42", "versionEndExcluding": "5.10.259", "versionStartIncluding": "4.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9", "versionEndExcluding": "6.12.94", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3", "versionEndExcluding": "6.18.36", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E", "versionEndExcluding": "7.0.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: diag: reject stale associations in dump_one path\n\nThe SCTP exact sock_diag lookup can hold a transport reference, block on\nlock_sock(sk), and then resume after sctp_association_free() has marked\nthe association dead and freed its bind address list.\n\nWhen that happens, inet_assoc_attr_size() and\ninet_diag_msg_sctpasoc_fill() can still dereference association state\nthat is no longer valid for reporting. In particular,\ninet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a\nreal sctp_sockaddr_entry and trigger an out-of-bounds read from\nunrelated association memory.\n\nReject the association after taking the socket lock if it has been\nreaped or detached from the endpoint, and report the lookup as stale.\nThis keeps the exact dump-one path from formatting torn association\nstate."}], "id": "CVE-2026-52917", "lastModified": "2026-10-19T20:18:46.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52917", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:22:37.939111Z", "version": "2.0.3"}}]}, "published": "2026-06-24T08:16:21.587", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/480f754580b5686b928977d16a59f20cef83ff01"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5425de8bd6e9fe5bd67d158e3348171ae7510117"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5eba3e48d78edd7551b992cb7ba687019b3a78da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6657af827e21883ae90693e42e7f59a6aab690b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/78c4f964b2f94e405721c093773f6250e1e676b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b2be72d401833194917e44fbd8d8144bb4f2db16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e97c2a535e23ed0fdd2660993fb3f10d9535c9bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f5af203dec6e0e7a6090fcc2130e9f3901bfc84d"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: sctp: diag: reject stale associations in dump_one path", "id": "2492115", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492115"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) diagnostics. When performing a socket diagnostic (sock_diag) lookup, the system may attempt to access memory related to an SCTP association that has already been freed. This can lead to an out-of-bounds read from unrelated memory, potentially allowing an attacker to access sensitive information or cause a system crash."], "name": "CVE-2026-52917", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52917\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52917\nhttps://lore.kernel.org/linux-cve-announce/2026062429-CVE-2026-52917-d3b0@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,6657af827e21883ae90693e42e7f59a6aab690b5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,b2be72d401833194917e44fbd8d8144bb4f2db16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,5425de8bd6e9fe5bd67d158e3348171ae7510117)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,e97c2a535e23ed0fdd2660993fb3f10d9535c9bc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,480f754580b5686b928977d16a59f20cef83ff01)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,78c4f964b2f94e405721c093773f6250e1e676b2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,f5af203dec6e0e7a6090fcc2130e9f3901bfc84d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,5eba3e48d78edd7551b992cb7ba687019b3a78da)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.259,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.94,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.36,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.13,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T13:00:06.140347+00:00", "updated": "2026-10-23T00:45:13.622542+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}