CVE-2026-68162

In the Linux kernel, the following vulnerability has been resolved:

sctp: avoid auth_enable sysctl UAF during netns teardown

proc_sctp_do_auth() updates the SCTP control socket after changing

net.sctp.auth_enable. The handler gets the per-net SCTP state from

ctl->data, so an already opened sysctl file can still target a network

namespace while that namespace is being torn down.

SCTP previously registered its per-net sysctls from sctp_defaults_init(),

while the control socket is created later from sctp_ctrlsock_init(). This

exposed a window during initialization where auth_enable was writable

before net->sctp.ctl_sock existed, and a teardown window where auth_enable

stayed writable after inet_ctl_sock_destroy() had released the control

socket.

Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after

sctp_ctl_sock_init() succeeds, and unregister the sysctl table before

destroying the control socket in sctp_ctrlsock_exit(). If sysctl

registration fails after the control socket was created, destroy the

control socket in the same init path.

Make sctp_sysctl_net_unregister() tolerate a missing header and clear the

saved pointer so init-error and exit paths can safely share the unregister

helper.