In the Linux kernel, the following vulnerability has been resolved:

sctp: avoid auth_enable sysctl UAF during netns teardown

proc_sctp_do_auth() updates the SCTP control socket after changing
net.sctp.auth_enable. The handler gets the per-net SCTP state from
ctl->data, so an already opened sysctl file can still target a network
namespace while that namespace is being torn down.

SCTP previously registered its per-net sysctls from sctp_defaults_init(),
while the control socket is created later from sctp_ctrlsock_init(). This
exposed a window during initialization where auth_enable was writable
before net->sctp.ctl_sock existed, and a teardown window where auth_enable
stayed writable after inet_ctl_sock_destroy() had released the control
socket.

Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after
sctp_ctl_sock_init() succeeds, and unregister the sysctl table before
destroying the control socket in sctp_ctrlsock_exit(). If sysctl
registration fails after the control socket was created, destroy the
control socket in the same init path.

Make sctp_sysctl_net_unregister() tolerate a missing header and clear the
saved pointer so init-error and exit paths can safely share the unregister
helper.

https://git.kernel.org/stable/c/19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4

https://git.kernel.org/stable/c/626bda8cfe43dff19a9833ff6ba055a817b5455c

https://git.kernel.org/stable/c/66700c0719675e0e118ae83b2d7168dacd69dd3d

https://git.kernel.org/stable/c/a50e73488e0bbdd262b3be3c9a1d8dd078382381

https://git.kernel.org/stable/c/be6aae9d1b91c603adb35872d37d40e83daf8758

https://git.kernel.org/stable/c/f8d5e7846025f4ab15a461235f8ebae9094a361a

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sctp/protocol.c","net/sctp/sysctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"10c869a52f266e40f548cc3c565d14930a5edafc","lessThan":"19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4","versionType":"git","status":"affected"},{"version":"7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6","lessThan":"66700c0719675e0e118ae83b2d7168dacd69dd3d","versionType":"git","status":"affected"},{"version":"c184bc621e3cef03ac9ba81a50dda2dae6a21d36","lessThan":"626bda8cfe43dff19a9833ff6ba055a817b5455c","versionType":"git","status":"affected"},{"version":"15649fd5415eda664ef35780c2013adeb5d9c695","lessThan":"be6aae9d1b91c603adb35872d37d40e83daf8758","versionType":"git","status":"affected"},{"version":"15649fd5415eda664ef35780c2013adeb5d9c695","lessThan":"a50e73488e0bbdd262b3be3c9a1d8dd078382381","versionType":"git","status":"affected"},{"version":"15649fd5415eda664ef35780c2013adeb5d9c695","lessThan":"f8d5e7846025f4ab15a461235f8ebae9094a361a","versionType":"git","status":"affected"},{"version":"dc583e7e5f8515ca489c0df28e4362a70eade382","versionType":"git","status":"affected"},{"version":"bd2a2939423566c654545fa3e96a656662a0af9e","versionType":"git","status":"affected"},{"version":"1b67030d39f2b00f94ac1f0af11ba6657589e4d3","versionType":"git","status":"affected"},{"version":"5.4.290","lessThan":"5.4.292","versionType":"semver","status":"affected"},{"version":"6.6.72","lessThan":"6.6.151","versionType":"semver","status":"affected"},{"version":"6.12.10","lessThan":"6.12.101","versionType":"semver","status":"affected"},{"version":"5.10.234","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.177","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.125","lessThan":"6.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sctp/protocol.c","net/sctp/sysctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"5.4.292","lessThanOrEqual":"5.4.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]