{"apiVersion":"1.0","identifier":"CVE-2026-72383","description":"In the Linux kernel, the following vulnerability has been resolved: sctp: fix addr_wq_timer race in sctp_free_addr_wq() sctp_free_addr_wq() previously removed addr_wq_timer using timer_delete() while holding addr_wq_lock. However, timer_delete() does not guarantee that a currently running timer handler has completed. This allows a race with sctp_addr_wq_timeout_handler(), where the handler may still run after addr_waitq has been freed, acquire addr_wq_lock, and access freed memory, leading to a use-after-free. Fix this by calling timer_shutdown_sync() before taking addr_wq_lock. This guarantees that any in-flight timer handler has finished and prevents the timer from being re-armed during teardown, making subsequent cleanup safe.","publishedAt":"2026-08-15T06:22:11","lastModifiedAt":"2026-08-17T06:18:42","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72383","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00157,"riskScore":0.79,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72383","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72383","en":"https://www.redsauce.net/en/cves/CVE-2026-72383","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72383","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72383","de":"https://www.redsauce.net/de/cves/CVE-2026-72383","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72383","el":"https://www.redsauce.net/el/cves/CVE-2026-72383"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72383"}}