CVE-2026-23125 - Vulnerability Details

- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT

A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key
initialization fails:

==================================================================
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2
RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline]
RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401
Call Trace:

sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189
sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111
sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217
sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787
sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]
sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169
sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052
sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88
sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243
sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127

The issue is triggered when sctp_auth_asoc_init_active_key() fails in
sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the
command sequence is currently:

- SCTP_CMD_PEER_INIT
- SCTP_CMD_TIMER_STOP (T1_INIT)
- SCTP_CMD_TIMER_START (T1_COOKIE)
- SCTP_CMD_NEW_STATE (COOKIE_ECHOED)
- SCTP_CMD_ASSOC_SHKEY
- SCTP_CMD_GEN_COOKIE_ECHO

If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while
asoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by
SCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL
to be queued by sctp_datamsg_from_user().

Since command interpretation stops on failure, no COOKIE_ECHO should been
sent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already
been started, and it may enqueue a COOKIE_ECHO into the outqueue later. As
a result, the DATA chunk can be transmitted together with the COOKIE_ECHO
in sctp_outq_flush_data(), leading to the observed issue.

Similar to the other places where it calls sctp_auth_asoc_init_active_key()
right after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY
immediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting
T1_COOKIE. This ensures that if shared key generation fails, authenticated
DATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT,
giving the client another chance to process INIT_ACK and retry key setup.

Published: 2026-02-14

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a null‑pointer dereference in the SCTP transmit path that occurs when the SCTP authentication key initialization fails. The flaw, classified as CWE‑476, allows the kernel to dereference a NULL shared‑key pointer while processing a DATA chunk with authentication enabled, leading to a kernel panic and system disruption.

Affected Systems

The issue affects Linux kernel builds that have not yet incorporated the command ordering change that moves SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT. Known affected releases include the 6.6.0 and 6.19 RC1 through RC6 kernels, plus any unpatched generic Linux kernel that accepts SCTP traffic. Any machine running an unpatched kernel and able to receive SCTP packets is susceptible.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, network‑based via SCTP: an attacker can craft an INIT_ACK packet that triggers the key‑initialization failure, leading the kernel to crash. Because the fault occurs during SCTP packet handling, the adversary must be able to send SCTP traffic to the target. The risk is mitigated by applying the patch that reorders the command sequence to prevent the race condition that allowed the null dereference.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5`	affected	< 5a309bedf02ee08b0653215f06c94d61ec7a214a
`730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5`	affected	< 784428ab1889eb185a1459e9d6bc52df33d572ef
`730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5`	affected	< e94294798548e8cfbd80869e1d2f97efce92582c
`730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5`	affected	< e7e81abbcc5620c9532080538f9709a6ea382855
`730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5`	affected	< bf2b543b3cc4ebb4ab5bca4f8dfa5612035d45b8
`730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5`	affected	< 0c4adb1f391a7b92a0405e9d7c05624c0d9f8a65
`730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5`	affected	< a80c9d945aef55b23b54838334345f20251dad83

Linux

affected

Version	Status	Constraints
`2.6.24`	affected	—
`0`	unaffected	< 2.6.24
`5.10.249`	unaffected	≤ 5.10.*
`5.15.199`	unaffected	≤ 5.15.*
`6.1.162`	unaffected	≤ 6.1.*
`6.6.122`	unaffected	≤ 6.6.*
`6.12.68`	unaffected	≤ 6.12.*
`6.18.8`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

—

Version	Status	Scheme	Platform
`[730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5,5a309bedf02ee08b0653215f06c94d61ec7a214a)`	affected	code_commit	—
`[730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5,784428ab1889eb185a1459e9d6bc52df33d572ef)`	affected	code_commit	—
`[730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5,e94294798548e8cfbd80869e1d2f97efce92582c)`	affected	code_commit	—
`[730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5,e7e81abbcc5620c9532080538f9709a6ea382855)`	affected	code_commit	—
`[730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5,bf2b543b3cc4ebb4ab5bca4f8dfa5612035d45b8)`	affected	code_commit	—
`[730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5,0c4adb1f391a7b92a0405e9d7c05624c0d9f8a65)`	affected	code_commit	—
`[730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5,a80c9d945aef55b23b54838334345f20251dad83)`	affected	code_commit	—

Linux

Linux Kernel

—

Version	Status	Scheme	Platform
`2.6.24`	affected	semver	—
`[0,2.6.24)`	unaffected	semver	—
`[5.10.249,5.11.0)`	unaffected	semver	—
`[5.15.199,5.16.0)`	unaffected	semver	—
`[6.1.162,6.2.0)`	unaffected	semver	—
`[6.6.122,6.7.0)`	unaffected	semver	—
`[6.12.68,6.13.0)`	unaffected	semver	—
`[6.18.8,6.19.0)`	unaffected	semver	—
`[6.19,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the SCTP_CMD_ASSOC_SHKEY ordering change, such as a release after 6.6.0 or newer.
If a full update is not possible, download the upstream patch that relocates SCTP_CMD_ASSOC_SHKEY and backport it to your current kernel source, then rebuild.
As a temporary countermeasure, block or drop SCTP traffic with firewall rules to prevent an attacker from sending malicious SCTP packets until the fix is applied.

Generated by OpenCVE AI on April 18, 2026 at 19:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8162-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8180-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8180-2	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8186-1	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8187-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8188-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0c4adb1f391a7b92a0405e9d7c05624c0d9f8a65
https://git.kernel.org/stable/c/5a309bedf02ee08b0653215f06c94d61ec7a214a
https://git.kernel.org/stable/c/784428ab1889eb185a1459e9d6bc52df33d572ef
https://git.kernel.org/stable/c/a80c9d945aef55b23b54838334345f20251dad83
https://git.kernel.org/stable/c/bf2b543b3cc4ebb4ab5bca4f8dfa5612035d45b8
https://git.kernel.org/stable/c/e7e81abbcc5620c9532080538f9709a6ea382855
https://git.kernel.org/stable/c/e94294798548e8cfbd80869e1d2f97efce92582c
https://lore.kernel.org/linux-cve-announce/2026021409-CVE-2026-23125-1ee3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23125
https://www.cve.org/CVERecord?id=CVE-2026-23125

History

Wed, 18 Mar 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Mon, 16 Feb 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021409-CVE-2026-23125-1ee3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23125 https://www.cve.org/CVERecord?id=CVE-2026-23125
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 14 Feb 2026 15:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ================================================================== KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2 RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline] RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401 Call Trace: sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189 sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111 sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217 sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787 sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline] sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169 sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052 sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88 sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243 sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127 The issue is triggered when sctp_auth_asoc_init_active_key() fails in sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the command sequence is currently: - SCTP_CMD_PEER_INIT - SCTP_CMD_TIMER_STOP (T1_INIT) - SCTP_CMD_TIMER_START (T1_COOKIE) - SCTP_CMD_NEW_STATE (COOKIE_ECHOED) - SCTP_CMD_ASSOC_SHKEY - SCTP_CMD_GEN_COOKIE_ECHO If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while asoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by SCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL to be queued by sctp_datamsg_from_user(). Since command interpretation stops on failure, no COOKIE_ECHO should been sent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already been started, and it may enqueue a COOKIE_ECHO into the outqueue later. As a result, the DATA chunk can be transmitted together with the COOKIE_ECHO in sctp_outq_flush_data(), leading to the observed issue. Similar to the other places where it calls sctp_auth_asoc_init_active_key() right after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting T1_COOKIE. This ensures that if shared key generation fails, authenticated DATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT, giving the client another chance to process INIT_ACK and retry key setup.
Title		sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c4adb1f391a7b92a0405e9d7c05624c0d9f8a65 https://git.kernel.org/stable/c/5a309bedf02ee08b0653215f06c94d61ec7a214a https://git.kernel.org/stable/c/784428ab1889eb185a1459e9d6bc52df33d572ef https://git.kernel.org/stable/c/a80c9d945aef55b23b54838334345f20251dad83 https://git.kernel.org/stable/c/bf2b543b3cc4ebb4ab5bca4f8dfa5612035d45b8 https://git.kernel.org/stable/c/e7e81abbcc5620c9532080538f9709a6ea382855 https://git.kernel.org/stable/c/e94294798548e8cfbd80869e1d2f97efce92582c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-02-14T15:09:54.756Z

Updated: 2026-02-14T15:09:54.756Z

Reserved: 2026-01-13T15:37:45.970Z

Link: CVE-2026-23125

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-02-14T15:16:07.740

Modified: 2026-03-18T14:50:20.100

Link: CVE-2026-23125

Redhat

Severity : Moderate

Publid Date: 2026-02-14T00:00:00Z

Links: CVE-2026-23125 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-18T19:45:08Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object