CVE-2026-89479
largeUse-After-Free in Linux Kernel SCTP Packet Processing via Bundled Chunks
A use-after-free exists in the Linux kernel's SCTP stack in sctp_endpoint_bh_rcv(), which caches a looked-up association and transport in the chunk without taking a reference and has no check that the association is still alive. A remote peer can trigger it by sending a single SCTP packet bundling COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK: the COOKIE ECHO creates the association, the SHUTDOWN caches it, and the SHUTDOWN ACK causes it (and its transports) to be freed while the endpoint loop is still processing the same packet, so the next chunk writes to the freed transport and passes the freed association into the state machine. Successful exploitation requires the packet to be processed from the socket backlog (task context, to race the RCU-delayed transport free), and yields kernel memory corruption on the target — scored CVSS 9.8 with high confidentiality, integrity, and availability impact, so kernel crashes are likely and code execution in kernel context is plausible. Any Linux system whose kernel includes the SCTP stack and that runs SCTP services reachable by untrusted peers (common in telecom/signaling deployments) is affected; specific fixed version numbers are not stated in the advisory, which references the upstream fix commit. No public proof of concept is known and the flaw is not in CISA's KEV catalog.
What to do: Apply distribution kernel updates as soon as they carry this upstream SCTP fix and reboot into the patched kernel. If SCTP is not needed, disable the sctp kernel module (blacklist it) and drop SCTP traffic (IP protocol 132) at perimeter firewalls to eliminate the remote attack surface. On SCTP-dependent systems, restrict peer access with firewall rules to trusted hosts and watch for unexplained kernel crashes or oopses referencing sctp_do_sm/sctp_endpoint_bh_rcv.
| Linux kernel (SCTP networking stack) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference. A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(), so the association and its transports are freed. The endpoint loop has no counterpart to the asoc->base.dead check in sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed transport and is then passed to sctp_do_sm() with the freed association. The transport is freed through RCU, so this needs the packet to come off the socket backlog, where the loop runs in task context. The endpoint loop cannot do the same check: it holds no reference on the association, so reading asoc->base.dead would itself be a use-after-free. Mark the packet for discard in the command interpreter, just before it deletes the association. That is also before sctp_inq_free() releases the chunk on the association receive path. sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary association, while the one the packet belongs to stays alive. A restarting peer can bundle DATA behind its COOKIE ECHO, so compare against chunk->asoc and leave that case alone.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.