CVE-2026-89477 - Vulnerability Details

- sctp: fix NULL deref on untransmitted RECONF completion

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix NULL deref on untransmitted RECONF completion

sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and
sctp_process_strreset_resp() complete a pending stream reconfiguration
request by stopping the reconf timer on the transport it was sent on:

t = asoc->strreset_chunk->transport;
if (timer_delete(&t->reconf_timer))
sctp_transport_put(t);

chunk->transport is assigned by __sctp_packet_append_chunk() when the
chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms
the reconf timer at that same point. A request already published in
asoc->strreset_chunk but not yet transmitted has neither, so completing
it dereferences NULL.

Two ways to get there. sctp_send_asconf_del_ip() sets
asoc->src_out_of_asoc_ok without sending anything when the address being
removed is the association's last one, and sctp_outq_flush_ctrl() then
leaves every non-ASCONF control chunk queued; as only
sctp_process_asconf_ack() clears that flag, it persists. An unprivileged
process that removes such an address and then asks for a stream reset
panics the kernel from softirq. A peer needs neither ASCONF nor local
help: sctp_cmd_interpreter() uncorks the outqueue only once the whole
packet has been processed, so a reply built while walking a RECONF chunk
stays untransmitted for the rest of that walk, and one RECONF chunk
carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,
Response] -- or two RECONF chunks in one packet -- reaches the same
dereference.

KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]
RIP: 0010:timer_delete+0x67/0x110
Call Trace:
<IRQ>
sctp_process_strreset_addstrm_out (net/sctp/stream.c:832)
sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212)
sctp_do_sm (net/sctp/sm_sideeffect.c:1172)
sctp_assoc_bh_rcv (net/sctp/associola.c:1044)
sctp_rcv (net/sctp/input.c:243)
ip_local_deliver (net/ipv4/ip_input.c:262)
process_backlog (net/core/dev.c:6680)
</IRQ>

A response can only acknowledge a request that was actually sent, so do
not match asoc->strreset_chunk while chunk->transport is NULL. Guarding
the lookup covers all three completion sites.

Published: 2026-09-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw occurs when an SCTP stream reconfiguration request has been queued but not yet transmitted and the completion routine deletes the reconfiguration timer. The code then dereferences a transport pointer that is NULL, causing a kernel panic. This results in an immediate loss of availability for the affected host, consistent with a denial‑of‑service condition. The weakness is a classic null pointer dereference (CWE-476).

Affected Systems

All Linux kernel installations that have SCTP support enabled – either compiled into the kernel or loaded as a module – are potentially affected. No specific kernel version is listed; any kernel build with generic SCTP code prior to the patched commit is vulnerable regardless of distribution.

Risk and Exploitability

With a CVSS score of 7.5 the vulnerability is classified as high severity. The EPSS score of less than 1 % indicates that exploitation is not widespread, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the fault locally by removing the last IP address from an association without sending an ASCONF update, or remotely by sending crafted SCTP reset messages that are received by a vulnerable host. The result is a kernel panic and disruption of service. Based on the description, it is inferred that the attack can be launched from either local or remote contexts, with the remote scenario requiring the ability to send SCTP packets to the target.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`81054476453640159149cb6704e834893e16736b`	affected	< 79ff751311e80fa0370007e46a79a6d601685e75
`81054476453640159149cb6704e834893e16736b`	affected	< 53141db979687eae7dc6d29414cefc77034f967e
`81054476453640159149cb6704e834893e16736b`	affected	< 68891125af5a5dfbca728809a16637a869bbe0df
`81054476453640159149cb6704e834893e16736b`	affected	< b2d6d873b4dfb5b84194061c4b40a1cd85b92ca4
`81054476453640159149cb6704e834893e16736b`	affected	< 77ea60f2d24002c308f224db44a4542c466489af
`81054476453640159149cb6704e834893e16736b`	affected	< 25419f516ea84b1e7d3d55aae5215ac86ece0c66
`81054476453640159149cb6704e834893e16736b`	affected	< 0ee697defc0594f1da810ed75d9d643fb46f5318
`81054476453640159149cb6704e834893e16736b`	affected	< 2db9bfa3e27bdea15e05ea70b56bad3d21e570ec

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[81054476453640159149cb6704e834893e16736b,77ea60f2d24002c308f224db44a4542c466489af)`	affected	code_commit	—
`[81054476453640159149cb6704e834893e16736b,25419f516ea84b1e7d3d55aae5215ac86ece0c66)`	affected	code_commit	—
`[81054476453640159149cb6704e834893e16736b,0ee697defc0594f1da810ed75d9d643fb46f5318)`	affected	code_commit	—
`[81054476453640159149cb6704e834893e16736b,2db9bfa3e27bdea15e05ea70b56bad3d21e570ec)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.11`	affected	semver	—
`[0,4.11)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that includes the SCTP null dereference fix.
If a kernel update cannot be applied immediately, disable SCTP support in the kernel configuration or unload the sctp kernel module to eliminate the vulnerable code path.
Block inbound SCTP traffic (port 132) with firewall rules so that reset and ASCONF packets cannot reach the vulnerable host.

Generated by OpenCVE AI on September 15, 2026 at 22:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00716.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0ee697defc0594f1da810ed75d9d643fb46f5318
https://git.kernel.org/stable/c/25419f516ea84b1e7d3d55aae5215ac86ece0c66
https://git.kernel.org/stable/c/2db9bfa3e27bdea15e05ea70b56bad3d21e570ec
https://git.kernel.org/stable/c/53141db979687eae7dc6d29414cefc77034f967e
https://git.kernel.org/stable/c/68891125af5a5dfbca728809a16637a869bbe0df
https://git.kernel.org/stable/c/77ea60f2d24002c308f224db44a4542c466489af
https://git.kernel.org/stable/c/79ff751311e80fa0370007e46a79a6d601685e75
https://git.kernel.org/stable/c/b2d6d873b4dfb5b84194061c4b40a1cd85b92ca4
https://nvd.nist.gov/vuln/detail/CVE-2026-89477
https://www.cve.org/CVERecord?id=CVE-2026-89477

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/53141db979687eae7dc6d29414cefc77034f967e https://git.kernel.org/stable/c/68891125af5a5dfbca728809a16637a869bbe0df https://git.kernel.org/stable/c/79ff751311e80fa0370007e46a79a6d601685e75 https://git.kernel.org/stable/c/b2d6d873b4dfb5b84194061c4b40a1cd85b92ca4

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89477 https://www.cve.org/CVERecord?id=CVE-2026-89477
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and sctp_process_strreset_resp() complete a pending stream reconfiguration request by stopping the reconf timer on the transport it was sent on: t = asoc->strreset_chunk->transport; if (timer_delete(&t->reconf_timer)) sctp_transport_put(t); chunk->transport is assigned by __sctp_packet_append_chunk() when the chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms the reconf timer at that same point. A request already published in asoc->strreset_chunk but not yet transmitted has neither, so completing it dereferences NULL. Two ways to get there. sctp_send_asconf_del_ip() sets asoc->src_out_of_asoc_ok without sending anything when the address being removed is the association's last one, and sctp_outq_flush_ctrl() then leaves every non-ASCONF control chunk queued; as only sctp_process_asconf_ack() clears that flag, it persists. An unprivileged process that removes such an address and then asks for a stream reset panics the kernel from softirq. A peer needs neither ASCONF nor local help: sctp_cmd_interpreter() uncorks the outqueue only once the whole packet has been processed, so a reply built while walking a RECONF chunk stays untransmitted for the rest of that walk, and one RECONF chunk carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request, Response] -- or two RECONF chunks in one packet -- reaches the same dereference. KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef] RIP: 0010:timer_delete+0x67/0x110 Call Trace: <IRQ> sctp_process_strreset_addstrm_out (net/sctp/stream.c:832) sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212) sctp_do_sm (net/sctp/sm_sideeffect.c:1172) sctp_assoc_bh_rcv (net/sctp/associola.c:1044) sctp_rcv (net/sctp/input.c:243) ip_local_deliver (net/ipv4/ip_input.c:262) process_backlog (net/core/dev.c:6680) </IRQ> A response can only acknowledge a request that was actually sent, so do not match asoc->strreset_chunk while chunk->transport is NULL. Guarding the lookup covers all three completion sites.
Title		sctp: fix NULL deref on untransmitted RECONF completion
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ee697defc0594f1da810ed75d9d643fb46f5318 https://git.kernel.org/stable/c/25419f516ea84b1e7d3d55aae5215ac86ece0c66 https://git.kernel.org/stable/c/2db9bfa3e27bdea15e05ea70b56bad3d21e570ec https://git.kernel.org/stable/c/77ea60f2d24002c308f224db44a4542c466489af

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:33.851Z

Updated: 2026-09-14T12:00:13.880Z

Reserved: 2026-09-11T19:38:34.711Z

Link: CVE-2026-89477

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:29.063

Modified: 2026-09-14T13:19:04.127

Link: CVE-2026-89477

Redhat

Severity : Important

Publid Date: 2026-09-11T19:43:33Z

Links: CVE-2026-89477 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T23:00:16Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object