{"apiVersion":"1.0","identifier":"CVE-2026-72242","description":"In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a struct socket * to selinux_socket_bind() and selinux_socket_connect_helper(). However, when the hook is invoked from the ASCONF softirq path (sctp_process_asconf), there is no file reference guaranteeing that sk->sk_socket is non-NULL. The setsockopt callers (bindx, connectx, set_primary, sendmsg connect) hold a file reference and are not affected. Both selinux_socket_bind() and selinux_socket_connect_helper() immediately resolve sock->sk, never using the struct socket * for anything else. Refactor the inner logic into helpers that take a struct sock * directly so that selinux_sctp_bind_connect() never needs to touch sk->sk_socket at all.","publishedAt":"2026-08-15T06:21:51","lastModifiedAt":"2026-08-23T13:16:42","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72242","cvssScore":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","epssProbability":0.00677,"riskScore":0.8,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72242","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72242","en":"https://www.redsauce.net/en/cves/CVE-2026-72242","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72242","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72242","de":"https://www.redsauce.net/de/cves/CVE-2026-72242","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72242","el":"https://www.redsauce.net/el/cves/CVE-2026-72242"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72242"}}