Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux Kernel SCTP Memory Leak in INIT Handling
published 2 months ago
Summary
A memory leak was fixed in the Linux kernel's SCTP protocol, which could lead to memory waste. This issue affects systems using SCTP, and while it's not a direct security risk, it's essential to update the kernel to prevent memory issues. Affected systems should be updated to the latest kernel version.
What to do
- Update linux kernel to version 7.1.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Linux | linux | kernel |
>= 2.6.12, < 7.1.5 Fix: upgrade to 7.1.5
|
Original advisory text
sctp: fix err_chunk memory leaks in INIT handling
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix err_chunk memory leaks in INIT handling
When sctp_verify_init() encounters unrecognized parameters, it allocates an
err_chunk to report them. However, this chunk is leaked in several code
paths:
1. In sctp_sf_do_5_1B_init(), if security_sctp_assoc_request() fails after
sctp_verify_init() has populated err_chunk, the function returns
immediately without freeing it.
2. In sctp_sf_do_unexpected_init(), the same leak occurs on the
security_sctp_assoc_request() failure path.
3. In sctp_sf_do_unexpected_init(), on the success path after copying
unrecognized parameters to the INIT-ACK, the function returns without
freeing err_chunk, unlike sctp_sf_do_5_1B_init() which properly frees
it.
Fix all three leaks by adding sctp_chunk_free(err_chunk) calls before
returning in the error paths and on the success path in
sctp_sf_do_unexpected_init().
sctp: fix err_chunk memory leaks in INIT handling
When sctp_verify_init() encounters unrecognized parameters, it allocates an
err_chunk to report them. However, this chunk is leaked in several code
paths:
1. In sctp_sf_do_5_1B_init(), if security_sctp_assoc_request() fails after
sctp_verify_init() has populated err_chunk, the function returns
immediately without freeing it.
2. In sctp_sf_do_unexpected_init(), the same leak occurs on the
security_sctp_assoc_request() failure path.
3. In sctp_sf_do_unexpected_init(), on the success path after copying
unrecognized parameters to the INIT-ACK, the function returns without
freeing err_chunk, unlike sctp_sf_do_5_1B_init() which properly frees
it.
Fix all three leaks by adding sctp_chunk_free(err_chunk) calls before
returning in the error paths and on the success path in
sctp_sf_do_unexpected_init().
References
- https://git.kernel.org/stable/c/94f55994e19e8f0676990b9d5015b58ab6a97e00 URL
- https://git.kernel.org/stable/c/9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72413... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-72413 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Timeline
Published15 Aug 2026
Updated18 Aug 2026
First seen18 Aug 2026
Track software like this
Free during beta