CVE-2026-89477

sctp: fix NULL deref on untransmitted RECONF completion

Published Sep 11, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix NULL deref on untransmitted RECONF completion

sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and
sctp_process_strreset_resp() complete a pending stream reconfiguration
request by stopping the reconf timer on the transport it was sent on:

t = asoc->strreset_chunk->transport;
if (timer_delete(&t->reconf_timer))
sctp_transport_put(t);

chunk->transport is assigned by __sctp_packet_append_chunk() when the
chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms
the reconf timer at that same point. A request already published in
asoc->strreset_chunk but not yet transmitted has neither, so completing
it dereferences NULL.

Two ways to get there. sctp_send_asconf_del_ip() sets
asoc->src_out_of_asoc_ok without sending anything when the address being
removed is the association's last one, and sctp_outq_flush_ctrl() then
leaves every non-ASCONF control chunk queued; as only
sctp_process_asconf_ack() clears that flag, it persists. An unprivileged
process that removes such an address and then asks for a stream reset
panics the kernel from softirq. A peer needs neither ASCONF nor local
help: sctp_cmd_interpreter() uncorks the outqueue only once the whole
packet has been processed, so a reply built while walking a RECONF chunk
stays untransmitted for the rest of that walk, and one RECONF chunk
carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,
Response] -- or two RECONF chunks in one packet -- reaches the same
dereference.

KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]
RIP: 0010:timer_delete+0x67/0x110
Call Trace:
<IRQ>
sctp_process_strreset_addstrm_out (net/sctp/stream.c:832)
sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212)
sctp_do_sm (net/sctp/sm_sideeffect.c:1172)
sctp_assoc_bh_rcv (net/sctp/associola.c:1044)
sctp_rcv (net/sctp/input.c:243)
ip_local_deliver (net/ipv4/ip_input.c:262)
process_backlog (net/core/dev.c:6680)
</IRQ>

A response can only acknowledge a request that was actually sent, so do
not match asoc->strreset_chunk while chunk->transport is NULL. Guarding
the lookup covers all three completion sites.

Analysis

Technical impact

The flaw occurs when an SCTP stream reconfiguration request has been queued but not yet transmitted and the completion routine deletes the reconfiguration timer. The code then dereferences a transport pointer that is NULL, causing a kernel panic. This results in an immediate loss of availability for the affected host, consistent with a denial‑of‑service condition. The weakness is a classic null pointer dereference (CWE-476).

Affected Systems

All Linux kernel installations that have SCTP support enabled – either compiled into the kernel or loaded as a module – are potentially affected. No specific kernel version is listed; any kernel build with generic SCTP code prior to the patched commit is vulnerable regardless of distribution.

Risk and Exploitability

With a CVSS score of 7.5 the vulnerability is classified as high severity. The EPSS score of less than 1 % indicates that exploitation is not widespread, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the fault locally by removing the last IP address from an association without sending an ASCONF update, or remotely by sending crafted SCTP reset messages that are received by a vulnerable host. The result is a kernel panic and disruption of service. Based on the description, it is inferred that the attack can be launched from either local or remote contexts, with the remote scenario requiring the ability to send SCTP packets to the target.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`81054476453640159149cb6704e834893e16736b`	affected	< 79ff751311e80fa0370007e46a79a6d601685e75
`81054476453640159149cb6704e834893e16736b`	affected	< 53141db979687eae7dc6d29414cefc77034f967e
`81054476453640159149cb6704e834893e16736b`	affected	< 68891125af5a5dfbca728809a16637a869bbe0df
`81054476453640159149cb6704e834893e16736b`	affected	< b2d6d873b4dfb5b84194061c4b40a1cd85b92ca4
`81054476453640159149cb6704e834893e16736b`	affected	< 77ea60f2d24002c308f224db44a4542c466489af
`81054476453640159149cb6704e834893e16736b`	affected	< 25419f516ea84b1e7d3d55aae5215ac86ece0c66
`81054476453640159149cb6704e834893e16736b`	affected	< 0ee697defc0594f1da810ed75d9d643fb46f5318
`81054476453640159149cb6704e834893e16736b`	affected	< 2db9bfa3e27bdea15e05ea70b56bad3d21e570ec

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[81054476453640159149cb6704e834893e16736b,77ea60f2d24002c308f224db44a4542c466489af)`	affected	code_commit	—
`[81054476453640159149cb6704e834893e16736b,25419f516ea84b1e7d3d55aae5215ac86ece0c66)`	affected	code_commit	—
`[81054476453640159149cb6704e834893e16736b,0ee697defc0594f1da810ed75d9d643fb46f5318)`	affected	code_commit	—
`[81054476453640159149cb6704e834893e16736b,2db9bfa3e27bdea15e05ea70b56bad3d21e570ec)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.11`	affected	semver	—
`[0,4.11)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that includes the SCTP null dereference fix.
If a kernel update cannot be applied immediately, disable SCTP support in the kernel configuration or unload the sctp kernel module to eliminate the vulnerable code path.
Block inbound SCTP traffic (port 132) with firewall rules so that reset and ASCONF packets cannot reach the vulnerable host.

Generated by OpenCVE AI on September 15, 2026 at 22:48 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.501% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/0ee697defc0594f1da810ed75d9d643fb46f5318
https://git.kernel.org/stable/c/25419f516ea84b1e7d3d55aae5215ac86ece0c66
https://git.kernel.org/stable/c/2db9bfa3e27bdea15e05ea70b56bad3d21e570ec
https://git.kernel.org/stable/c/53141db979687eae7dc6d29414cefc77034f967e
https://git.kernel.org/stable/c/68891125af5a5dfbca728809a16637a869bbe0df
https://git.kernel.org/stable/c/77ea60f2d24002c308f224db44a4542c466489af
https://git.kernel.org/stable/c/79ff751311e80fa0370007e46a79a6d601685e75
https://git.kernel.org/stable/c/b2d6d873b4dfb5b84194061c4b40a1cd85b92ca4
https://nvd.nist.gov/vuln/detail/CVE-2026-89477
https://www.cve.org/CVERecord?id=CVE-2026-89477

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/53141db979687eae7dc6d29414cefc77034f967e https://git.kernel.org/stable/c/68891125af5a5dfbca728809a16637a869bbe0df https://git.kernel.org/stable/c/79ff751311e80fa0370007e46a79a6d601685e75 https://git.kernel.org/stable/c/b2d6d873b4dfb5b84194061c4b40a1cd85b92ca4

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89477 https://www.cve.org/CVERecord?id=CVE-2026-89477
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and sctp_process_strreset_resp() complete a pending stream reconfiguration request by stopping the reconf timer on the transport it was sent on: t = asoc->strreset_chunk->transport; if (timer_delete(&t->reconf_timer)) sctp_transport_put(t); chunk->transport is assigned by __sctp_packet_append_chunk() when the chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms the reconf timer at that same point. A request already published in asoc->strreset_chunk but not yet transmitted has neither, so completing it dereferences NULL. Two ways to get there. sctp_send_asconf_del_ip() sets asoc->src_out_of_asoc_ok without sending anything when the address being removed is the association's last one, and sctp_outq_flush_ctrl() then leaves every non-ASCONF control chunk queued; as only sctp_process_asconf_ack() clears that flag, it persists. An unprivileged process that removes such an address and then asks for a stream reset panics the kernel from softirq. A peer needs neither ASCONF nor local help: sctp_cmd_interpreter() uncorks the outqueue only once the whole packet has been processed, so a reply built while walking a RECONF chunk stays untransmitted for the rest of that walk, and one RECONF chunk carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request, Response] -- or two RECONF chunks in one packet -- reaches the same dereference. KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef] RIP: 0010:timer_delete+0x67/0x110 Call Trace: <IRQ> sctp_process_strreset_addstrm_out (net/sctp/stream.c:832) sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212) sctp_do_sm (net/sctp/sm_sideeffect.c:1172) sctp_assoc_bh_rcv (net/sctp/associola.c:1044) sctp_rcv (net/sctp/input.c:243) ip_local_deliver (net/ipv4/ip_input.c:262) process_backlog (net/core/dev.c:6680) </IRQ> A response can only acknowledge a request that was actually sent, so do not match asoc->strreset_chunk while chunk->transport is NULL. Guarding the lookup covers all three completion sites.
Title		sctp: fix NULL deref on untransmitted RECONF completion
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ee697defc0594f1da810ed75d9d643fb46f5318 https://git.kernel.org/stable/c/25419f516ea84b1e7d3d55aae5215ac86ece0c66 https://git.kernel.org/stable/c/2db9bfa3e27bdea15e05ea70b56bad3d21e570ec https://git.kernel.org/stable/c/77ea60f2d24002c308f224db44a4542c466489af