CVE-2026-89476

sctp: fix stream->outcnt underflow on duplicate RECONF responses

Published Sep 11, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix stream->outcnt underflow on duplicate RECONF responses

A cached RECONF chunk may contain more than one request parameter. A
duplicate response can therefore find and process the same ADD_OUT request
again while another parameter is still outstanding, rolling back outcnt
twice and possibly underflowing it.

Track outstanding request types as bits and clear each bit after its first
response. Later responses for the same request are then ignored.

Analysis

Technical impact

The Linux kernel’s SCTP stack contains a flaw where duplicate RECONF responses can decrement the stream->outcnt counter twice, potentially causing an integer underflow. When the counter wraps below zero, kernel state can become inconsistent, which may result in crashes, memory corruption, or other unpredictable behavior. Based on the description, an attacker could trigger this underflow by sending SCTP packets that provoke duplicate RECONF responses; the likely attack vector is remote over the network.

Affected Systems

All distributions’ Linux kernels that include the default SCTP implementation and have not incorporated the patch commits referenced in the advisory (for example, 2d867663…, 3faf13aff…, 8320cbd81…, d02a5794…). These are common across vendors such as Red Hat, Ubuntu, Debian, Fedora, CentOS, and others.

Risk and Exploitability

The CVSS score of 7.5 rates this flaw as high severity. The EPSS score of less than 1 % indicates a very low but nonzero probability of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. Even with low exploitation likelihood, the impact on kernel stability warrants timely remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`11ae76e67a179f25ae8f772d62a7ddf717b1cdf3`	affected	< 041f7df5a929d3e7435dd8387e8ea17f2d412b7d
`11ae76e67a179f25ae8f772d62a7ddf717b1cdf3`	affected	< 59f61c39cb99ee1737bd742a20094fe5653389bb
`11ae76e67a179f25ae8f772d62a7ddf717b1cdf3`	affected	< 793519e343867ee9a3e84f6cac07f81f2aec7b5d
`11ae76e67a179f25ae8f772d62a7ddf717b1cdf3`	affected	< 092acd3c55a4077b00489064615d8d2d898daf91
`11ae76e67a179f25ae8f772d62a7ddf717b1cdf3`	affected	< 2d867663c563e8009257b9edf9c8ec75d9bbf19a
`11ae76e67a179f25ae8f772d62a7ddf717b1cdf3`	affected	< d02a5794c3deedcb8476d017fcee2b7aaedab2e1
`11ae76e67a179f25ae8f772d62a7ddf717b1cdf3`	affected	< 8320cbd81bc21a1ca6ebdf70ad610ebc5ef1bd68
`11ae76e67a179f25ae8f772d62a7ddf717b1cdf3`	affected	< 3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e

Linux

affected

Version	Status	Constraints
`4.12`	affected	—
`0`	unaffected	< 4.12
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[11ae76e67a179f25ae8f772d62a7ddf717b1cdf3,2d867663c563e8009257b9edf9c8ec75d9bbf19a)`	affected	code_commit	—
`[11ae76e67a179f25ae8f772d62a7ddf717b1cdf3,d02a5794c3deedcb8476d017fcee2b7aaedab2e1)`	affected	code_commit	—
`[11ae76e67a179f25ae8f772d62a7ddf717b1cdf3,8320cbd81bc21a1ca6ebdf70ad610ebc5ef1bd68)`	affected	code_commit	—
`[11ae76e67a179f25ae8f772d62a7ddf717b1cdf3,3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.12`	affected	generic	—
`[0,4.12)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch commits referenced in the advisory, which fix the underflow bug.
If an immediate update is unavailable, disable SCTP support in the kernel by unloading the module with `modprobe -r sctp` or rebuilding the kernel without SCTP enabled.
Block inbound SCTP traffic on the network with firewall or netfilter rules to prevent malicious packets from reaching the vulnerable kernel code.

Generated by OpenCVE AI on September 21, 2026 at 01:04 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.696% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/041f7df5a929d3e7435dd8387e8ea17f2d412b7d
https://git.kernel.org/stable/c/092acd3c55a4077b00489064615d8d2d898daf91
https://git.kernel.org/stable/c/2d867663c563e8009257b9edf9c8ec75d9bbf19a
https://git.kernel.org/stable/c/3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e
https://git.kernel.org/stable/c/59f61c39cb99ee1737bd742a20094fe5653389bb
https://git.kernel.org/stable/c/793519e343867ee9a3e84f6cac07f81f2aec7b5d
https://git.kernel.org/stable/c/8320cbd81bc21a1ca6ebdf70ad610ebc5ef1bd68
https://git.kernel.org/stable/c/d02a5794c3deedcb8476d017fcee2b7aaedab2e1
https://nvd.nist.gov/vuln/detail/CVE-2026-89476
https://www.cve.org/CVERecord?id=CVE-2026-89476

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/041f7df5a929d3e7435dd8387e8ea17f2d412b7d https://git.kernel.org/stable/c/092acd3c55a4077b00489064615d8d2d898daf91 https://git.kernel.org/stable/c/59f61c39cb99ee1737bd742a20094fe5653389bb https://git.kernel.org/stable/c/793519e343867ee9a3e84f6cac07f81f2aec7b5d

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-191
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89476 https://www.cve.org/CVERecord?id=CVE-2026-89476
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream->outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADD_OUT request again while another parameter is still outstanding, rolling back outcnt twice and possibly underflowing it. Track outstanding request types as bits and clear each bit after its first response. Later responses for the same request are then ignored.
Title		sctp: fix stream->outcnt underflow on duplicate RECONF responses
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2d867663c563e8009257b9edf9c8ec75d9bbf19a https://git.kernel.org/stable/c/3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e https://git.kernel.org/stable/c/8320cbd81bc21a1ca6ebdf70ad610ebc5ef1bd68 https://git.kernel.org/stable/c/d02a5794c3deedcb8476d017fcee2b7aaedab2e1