---
title: "CVE-2026-68162 — An SCTP settings write could race a network namespace shutdown"
description: "CVE-2026-68162: During network namespace shutdown, Linux destroyed SCTP’s internal control socket before removing the settings table that still referred to it. A settings write racing that shutdown could therefore lock and modify a socket that had already been freed. Fixed upstream in July 2026."
url: https://nebusec.ai/buglist/CVE-2026-68162/
published: 2026-08-28T00:00:00.000Z
---

CVE-2026-68162 · High

# An SCTP settings write could race a network namespace shutdown

Linux kernel · SCTP · Published Aug 28, 2026

proc_sctp_do_auth

* [CVSS 7.8 · CNA ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-68162)
* Fixed
* Use-after-free
* Namespace required

Affects · Linux v6.13-rc7 until the fix · Ubuntu 26.04 · Linux 7.0.0-28 demo target

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

## Summary

During network namespace shutdown, Linux destroyed SCTP’s internal control socket before removing the settings table that still referred to it. A settings write racing that shutdown could therefore lock and modify a socket that had already been freed.

The lifetime mismatch was introduced in January 2025 and fixed upstream in July 2026. The public demonstration targeted Ubuntu 26.04 with Linux 7.0.0-28.

## Why it mattered

A local attacker who could create and tear down network namespaces could repeatedly race an SCTP authentication setting against cleanup. Winning the race yielded access to reused kernel memory and a path to local privilege escalation.

The affected code has been fixed. The risk described here applies to unpatched kernels in the affected line, not automatically to every system using the named distribution today.

## What went wrong

`proc_sctp_do_auth()` copied `net->sctp.ctl_sock` without lifetime protection. Teardown released that socket first, did not clear the stored pointer, and only later unregistered the sysctl handler that could still dereference it.

## Exploit

Because the issue and its fixes are public, NebuSec’s validation code is included here for reproducibility. The preview starts at the program entry point and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; build files, headers, helpers, and any additional sources remain in the linked CyberMeowfia directory.

Public exploit · patched target

CyberMeowfia snapshot4c1f0aa

[Browse all files](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-68162-Ubuntu-7.0.0-28)

Exploit entry point · 1161 lines · [Open at main() ↗](https://github.com/NebuSec/CyberMeowfia/blob/4c1f0aaaf1b981e74c47f24d88ebdf6ad51c9586/security-research/Linux-CVE-2026-68162-Ubuntu-7.0.0-28/exploit.c#L904)

```c
int main(void)
{
  struct rlimit nofile = { .rlim_cur = 8192, .rlim_max = 8192 };
  pthread_t fuse_thread;
  pthread_t stalled_threads[CHILDREN];
  pthread_attr_t stalled_attr;
  struct writer_argument writer_arguments[CHILDREN];
  int target_fds[WRITER_COUNT];
  int target_count = 0;
  int preload;
  int groom_fds[GROOM_SOCKETS];
  int post_fds[POST_SOCKETS];
  pthread_t recycler_threads[2];
  int recycler_cpus[2] = { 0, 1 };
  int seeder_ready[2];
```

The selected file is the execution entry point. Build files, headers, leak helpers, and supporting sources remain in the linked CyberMeowfia directory.

## Patch

**Fixed upstream in July 2026.** The corrected teardown ordering and lifetime handling prevent settings writes from reaching a released socket. Upgrade to the Ubuntu kernel containing the July 2026 fix; disabling SCTP in unpatched, namespace-heavy environments can reduce exposure.

The safest check is the distribution’s own kernel changelog for `CVE-2026-68162`; version numbers alone can be misleading because vendors routinely backport security fixes without changing to the newest upstream kernel.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)