CVE-2026-89477
moderateLinux Kernel SCTP Stream Reconfig NULL Dereference Allows Remote Kernel Panic
The Linux kernel's SCTP stream reconfiguration code completes a pending RECONF request by stopping a reconf timer on the transport that carried it, but a request that is queued in asoc->strreset_chunk yet never transmitted has a NULL transport pointer, so completing it (in sctp_process_strreset_outreq, sctp_process_strreset_addstrm_out, or sctp_process_strreset_resp) dereferences NULL and panics the kernel from softirq. A remote, unauthenticated SCTP peer can reach this path with one packet carrying a RECONF chunk containing [Incoming SSN Reset Request, Outgoing SSN Reset Request, Response] or two RECONF chunks in a single packet, with no ASCONF support or local privileges required; alternatively, an unprivileged local process can trigger the same panic by deleting the association's last address and then requesting a stream reset. The impact is availability only (CVSS 3.1: 7.5, A:H) — a remote attacker can crash any SCTP-enabled Linux host with which it can establish an association. Affected systems are Linux kernels with the SCTP stack in use, most notably telecom/signaling (SIGTRAN, Diameter) deployments, since most distributions ship the sctp module unloaded and SCTP is rarely internet-exposed. No public PoC is known, the flaw is not in CISA's KEV, and there is no evidence of exploitation in the wild.
What to do: Upgrade to a kernel containing the upstream fix that skips matching asoc->strreset_chunk when chunk->transport is NULL; since no version range was published, apply your distro's kernel update as soon as it ships the patch. If SCTP is not needed, blacklist the sctp module (e.g., via /etc/modprobe.d) and drop IP protocol 132 at perimeter firewalls. On SCTP-dependent systems (telecom signaling), verify module status with 'lsmod | grep sctp' and monitor for panics in sctp_process_strreset_* call paths when assessing exposure.
| Linux kernel (SCTP stream reconfiguration / RECONF handling) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and sctp_process_strreset_resp() complete a pending stream reconfiguration request by stopping the reconf timer on the transport it was sent on: t = asoc->strreset_chunk->transport; if (timer_delete(&t->reconf_timer)) sctp_transport_put(t); chunk->transport is assigned by __sctp_packet_append_chunk() when the chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms the reconf timer at that same point. A request already published in asoc->strreset_chunk but not yet transmitted has neither, so completing it dereferences NULL. Two ways to get there. sctp_send_asconf_del_ip() sets asoc->src_out_of_asoc_ok without sending anything when the address being removed is the association's last one, and sctp_outq_flush_ctrl() then leaves every non-ASCONF control chunk queued; as only sctp_process_asconf_ack() clears that flag, it persists. An unprivileged process that removes such an address and then asks for a stream reset panics the kernel from softirq. A peer needs neither ASCONF nor local help: sctp_cmd_interpreter() uncorks the outqueue only once the whole packet has been processed, so a reply built while walking a RECONF chunk stays untransmitted for the rest of that walk, and one RECONF chunk carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request, Response] -- or two RECONF chunks in one packet -- reaches the same dereference. KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef] RIP: 0010:timer_delete+0x67/0x110 Call Trace: sctp_process_strreset_addstrm_out (net/sctp/stream.c:832) sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212) sctp_do_sm (net/sctp/sm_sideeffect.c:1172) sctp_assoc_bh_rcv (net/sctp/associola.c:1044) sctp_rcv (net/sctp/input.c:243) ip_local_deliver (net/ipv4/ip_input.c:262) process_backlog (net/core/dev.c:6680) A response can only acknowledge a request that was actually sent, so do not match asoc->strreset_chunk while chunk->transport is NULL. Guarding the lookup covers all three completion sites.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.