ZDI-26-689: Linux Kernel SCTP Subsystem Race Condition Information Disclosure Vulnerability
ZDI discloses Linux Kernel SCTP subsystem race condition (CVE-2026-46227) allowing low-privileged local attackers to disclose sensitive information, CVSS 6.4.
ZDI-26-689 describes a race condition information disclosure vulnerability in the Linux Kernel SCTP subsystem, assigned CVE-2026-46227 with a CVSS rating of 6.4. An attacker needs the ability to execute low-privileged code on the target system to exploit the flaw. The vulnerability exposes sensitive information from affected installations.
- CVE-2026-46227, CVSS 6.4, Linux Kernel SCTP subsystem
- Local information disclosure via race condition
- Requires prior low-privileged code execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-46227 | Linux kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.