CVE-2026-89477 - Vulnerability Details

- sctp: fix NULL deref on untransmitted RECONF completion

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix NULL deref on untransmitted RECONF completion

sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and
sctp_process_strreset_resp() complete a pending stream reconfiguration
request by stopping the reconf timer on the transport it was sent on:

t = asoc->strreset_chunk->transport;
if (timer_delete(&t->reconf_timer))
sctp_transport_put(t);

chunk->transport is assigned by __sctp_packet_append_chunk() when the
chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms
the reconf timer at that same point. A request already published in
asoc->strreset_chunk but not yet transmitted has neither, so completing
it dereferences NULL.

Two ways to get there. sctp_send_asconf_del_ip() sets
asoc->src_out_of_asoc_ok without sending anything when the address being
removed is the association's last one, and sctp_outq_flush_ctrl() then
leaves every non-ASCONF control chunk queued; as only
sctp_process_asconf_ack() clears that flag, it persists. An unprivileged
process that removes such an address and then asks for a stream reset
panics the kernel from softirq. A peer needs neither ASCONF nor local
help: sctp_cmd_interpreter() uncorks the outqueue only once the whole
packet has been processed, so a reply built while walking a RECONF chunk
stays untransmitted for the rest of that walk, and one RECONF chunk
carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,
Response] -- or two RECONF chunks in one packet -- reaches the same
dereference.

KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]
RIP: 0010:timer_delete+0x67/0x110
Call Trace:
<IRQ>
sctp_process_strreset_addstrm_out (net/sctp/stream.c:832)
sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212)
sctp_do_sm (net/sctp/sm_sideeffect.c:1172)
sctp_assoc_bh_rcv (net/sctp/associola.c:1044)
sctp_rcv (net/sctp/input.c:243)
ip_local_deliver (net/ipv4/ip_input.c:262)
process_backlog (net/core/dev.c:6680)
</IRQ>

A response can only acknowledge a request that was actually sent, so do
not match asoc->strreset_chunk while chunk->transport is NULL. Guarding
the lookup covers all three completion sites.

Published: 2026-09-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL dereference in the Linux kernel’s SCTP implementation causes the kernel to panic when an untransmitted reconfiguration chunk is completed. This is a NULL pointer dereference flaw (CWE-476). The fault occurs during timer deletion on a transport pointer that is NULL, leading to a system‑wide denial of service caused by a kernel crash.

Affected Systems

All Linux kernel builds that compile with SCTP support (CONFIG_SCTP=y) are affected until the patch is applied; no specific version range is given in the advisory.

Risk and Exploitability

The CVSS score of 5.9 rates the vulnerability as moderate, and the EPSS score of <1 % indicates a very low likelihood of listed in CISA KEV. An unprivileged local process that removes the last IP address from an association and then requests a stream reset triggers the crash from softirq context, and an external peer can cause the same effect by sending crafted SCTP packets that result in an untransmitted RECONF chunk, enabling remote exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`81054476453640159149cb6704e834893e16736b`	affected	< 77ea60f2d24002c308f224db44a4542c466489af
`81054476453640159149cb6704e834893e16736b`	affected	< 25419f516ea84b1e7d3d55aae5215ac86ece0c66
`81054476453640159149cb6704e834893e16736b`	affected	< 0ee697defc0594f1da810ed75d9d643fb46f5318
`81054476453640159149cb6704e834893e16736b`	affected	< 2db9bfa3e27bdea15e05ea70b56bad3d21e570ec

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[81054476453640159149cb6704e834893e16736b,77ea60f2d24002c308f224db44a4542c466489af)`	affected	code_commit	—
`[81054476453640159149cb6704e834893e16736b,25419f516ea84b1e7d3d55aae5215ac86ece0c66)`	affected	code_commit	—
`[81054476453640159149cb6704e834893e16736b,0ee697defc0594f1da810ed75d9d643fb46f5318)`	affected	code_commit	—
`[81054476453640159149cb6704e834893e16736b,2db9bfa3e27bdea15e05ea70b56bad3d21e570ec)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.11`	affected	semver	—
`[0,4.11)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that fixes the NULL dereference in the SCTP reconfiguration completion logic.
If patch cannot be applied immediately, disable SCTP support in the kernel configuration (CONFIG_SCTP=n) or unload the SCTP module.
As a temporary network mitigation, block SCTP traffic on port 132 on all hosts or networks to prevent remote peers from sending crafted packets.

Generated by OpenCVE AI on September 13, 2026 at 07:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0ee697defc0594f1da810ed75d9d643fb46f5318
https://git.kernel.org/stable/c/25419f516ea84b1e7d3d55aae5215ac86ece0c66
https://git.kernel.org/stable/c/2db9bfa3e27bdea15e05ea70b56bad3d21e570ec
https://git.kernel.org/stable/c/77ea60f2d24002c308f224db44a4542c466489af
https://nvd.nist.gov/vuln/detail/CVE-2026-89477
https://www.cve.org/CVERecord?id=CVE-2026-89477

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89477 https://www.cve.org/CVERecord?id=CVE-2026-89477
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and sctp_process_strreset_resp() complete a pending stream reconfiguration request by stopping the reconf timer on the transport it was sent on: t = asoc->strreset_chunk->transport; if (timer_delete(&t->reconf_timer)) sctp_transport_put(t); chunk->transport is assigned by __sctp_packet_append_chunk() when the chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms the reconf timer at that same point. A request already published in asoc->strreset_chunk but not yet transmitted has neither, so completing it dereferences NULL. Two ways to get there. sctp_send_asconf_del_ip() sets asoc->src_out_of_asoc_ok without sending anything when the address being removed is the association's last one, and sctp_outq_flush_ctrl() then leaves every non-ASCONF control chunk queued; as only sctp_process_asconf_ack() clears that flag, it persists. An unprivileged process that removes such an address and then asks for a stream reset panics the kernel from softirq. A peer needs neither ASCONF nor local help: sctp_cmd_interpreter() uncorks the outqueue only once the whole packet has been processed, so a reply built while walking a RECONF chunk stays untransmitted for the rest of that walk, and one RECONF chunk carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request, Response] -- or two RECONF chunks in one packet -- reaches the same dereference. KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef] RIP: 0010:timer_delete+0x67/0x110 Call Trace: <IRQ> sctp_process_strreset_addstrm_out (net/sctp/stream.c:832) sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212) sctp_do_sm (net/sctp/sm_sideeffect.c:1172) sctp_assoc_bh_rcv (net/sctp/associola.c:1044) sctp_rcv (net/sctp/input.c:243) ip_local_deliver (net/ipv4/ip_input.c:262) process_backlog (net/core/dev.c:6680) </IRQ> A response can only acknowledge a request that was actually sent, so do not match asoc->strreset_chunk while chunk->transport is NULL. Guarding the lookup covers all three completion sites.
Title		sctp: fix NULL deref on untransmitted RECONF completion
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ee697defc0594f1da810ed75d9d643fb46f5318 https://git.kernel.org/stable/c/25419f516ea84b1e7d3d55aae5215ac86ece0c66 https://git.kernel.org/stable/c/2db9bfa3e27bdea15e05ea70b56bad3d21e570ec https://git.kernel.org/stable/c/77ea60f2d24002c308f224db44a4542c466489af

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:33.851Z

Updated: 2026-09-13T06:29:45.384Z

Reserved: 2026-09-11T19:38:34.711Z

Link: CVE-2026-89477

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:29.063

Modified: 2026-09-13T07:17:10.790

Link: CVE-2026-89477

Redhat

Severity : Important

Publid Date: 2026-09-11T19:43:33Z

Links: CVE-2026-89477 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T07:15:17Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object