CVE-2026-89478 - Vulnerability Details

- sctp: drop a chunk if its transport was removed

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: drop a chunk if its transport was removed

sctp_rcv() resolves the transport once per packet and leaves it in
chunk->transport. The lookup reference, or the one sctp_add_backlog() takes
if the socket is owned by userspace, keeps it around until the chunk has
been processed.

An authenticated ASCONF DEL-IP can remove it in the meantime.
sctp_assoc_rm_peer() takes the transport out of the association and calls
sctp_transport_free(), which tags it dead and drops the reference the
association held. There is a window on both paths: the packet can sit on
the socket backlog, and on the direct path the lookup completes before
bh_lock_sock().

The DATA chunk in that packet puts the removed transport back into
asoc->peer.last_data_from. Once the packet is done that reference goes
away and the transport is freed by RCU, so the next delayed SACK carries
the pointer into the SACK chunk and sctp_outq_select_transport() reads the
freed transport's state.

Drop the chunk in sctp_inq_push(), next to the existing rcvr->dead check.
Both paths reach it with the association's socket lock held. The peer
retransmits it.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux kernel SCTP stack allows an authenticated ASCONF DEL‑IP operation to remove a transport while a pending data chunk still references it, causing the transport to be freed before the chunk is processed. The stale reference is later dereferenced during delayed SACK processing, leading to a kernel crash and rendering the host unavailable. The vulnerability is identified as a resource management error consistent with CWE‑825.

Affected Systems

Linux kernels with SCTP support that have not yet incorporated commit 03a9d10ecf71f54b2af8020935f2033d4a132be5 are affected. This includes most distributions that ship with SCTP enabled in the kernel and have not applied the fix.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical risk to system availability. The EPSS score of less than 1% suggests that verified exploitation is considered unlikely, but not impossible. The flaw is not cataloged in CISA KEV, and it requires an attacker with the privilege to issue an ASCONF DEL‑IP command on an SCTP association, which would terminate the operating system’s kernel, causing service disruption; no known remote exploitation vectors or public exploits are documented.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3fc072e7cb4a0ff251d13cfc2d24f62489cd9386
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d7cb5ad832095dc4becfdb2a36007ffd50e49fb0
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 0422b092a3d43ca462932ff9f747731ca078d1d4
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 928fd7920ba37cc5637a211b9be979083413a2fa
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c6c86a5e62a4fec36692ddd64b9144b660f71f96
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1035bdef1efb9b1076d1a57b81e08c637ff08ecc
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3537961df2163258bddc230db0e18dc14e925ea6
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 03a9d10ecf71f54b2af8020935f2033d4a132be5

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c6c86a5e62a4fec36692ddd64b9144b660f71f96)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1035bdef1efb9b1076d1a57b81e08c637ff08ecc)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3537961df2163258bddc230db0e18dc14e925ea6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,03a9d10ecf71f54b2af8020935f2033d4a132be5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a Linux kernel version that incorporates commit 03a9d10ecf71f54b2af8020935f2033d4a132be5 or later.
If a kernel upgrade is not feasible, recompile the kernel with CONFIG_SCTP=n to disable the SCTP stack, or employ an eBPF or SELinux policy to restrict SCTP traffic to trusted hosts.
Block SCTP traffic at the network perimeter to prevent ASCONF DEL‑IP messages from reaching the kernel when SCTP must remain enabled.

Generated by OpenCVE AI on September 15, 2026 at 22:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00755.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/03a9d10ecf71f54b2af8020935f2033d4a132be5
https://git.kernel.org/stable/c/0422b092a3d43ca462932ff9f747731ca078d1d4
https://git.kernel.org/stable/c/1035bdef1efb9b1076d1a57b81e08c637ff08ecc
https://git.kernel.org/stable/c/3537961df2163258bddc230db0e18dc14e925ea6
https://git.kernel.org/stable/c/3fc072e7cb4a0ff251d13cfc2d24f62489cd9386
https://git.kernel.org/stable/c/928fd7920ba37cc5637a211b9be979083413a2fa
https://git.kernel.org/stable/c/c6c86a5e62a4fec36692ddd64b9144b660f71f96
https://git.kernel.org/stable/c/d7cb5ad832095dc4becfdb2a36007ffd50e49fb0
https://nvd.nist.gov/vuln/detail/CVE-2026-89478
https://www.cve.org/CVERecord?id=CVE-2026-89478

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0422b092a3d43ca462932ff9f747731ca078d1d4 https://git.kernel.org/stable/c/3fc072e7cb4a0ff251d13cfc2d24f62489cd9386 https://git.kernel.org/stable/c/928fd7920ba37cc5637a211b9be979083413a2fa https://git.kernel.org/stable/c/d7cb5ad832095dc4becfdb2a36007ffd50e49fb0

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89478 https://www.cve.org/CVERecord?id=CVE-2026-89478
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves the transport once per packet and leaves it in chunk->transport. The lookup reference, or the one sctp_add_backlog() takes if the socket is owned by userspace, keeps it around until the chunk has been processed. An authenticated ASCONF DEL-IP can remove it in the meantime. sctp_assoc_rm_peer() takes the transport out of the association and calls sctp_transport_free(), which tags it dead and drops the reference the association held. There is a window on both paths: the packet can sit on the socket backlog, and on the direct path the lookup completes before bh_lock_sock(). The DATA chunk in that packet puts the removed transport back into asoc->peer.last_data_from. Once the packet is done that reference goes away and the transport is freed by RCU, so the next delayed SACK carries the pointer into the SACK chunk and sctp_outq_select_transport() reads the freed transport's state. Drop the chunk in sctp_inq_push(), next to the existing rcvr->dead check. Both paths reach it with the association's socket lock held. The peer retransmits it.
Title		sctp: drop a chunk if its transport was removed
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/03a9d10ecf71f54b2af8020935f2033d4a132be5 https://git.kernel.org/stable/c/1035bdef1efb9b1076d1a57b81e08c637ff08ecc https://git.kernel.org/stable/c/3537961df2163258bddc230db0e18dc14e925ea6 https://git.kernel.org/stable/c/c6c86a5e62a4fec36692ddd64b9144b660f71f96

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:34.588Z

Updated: 2026-09-14T12:00:14.944Z

Reserved: 2026-09-11T19:38:34.711Z

Link: CVE-2026-89478

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:29.207

Modified: 2026-09-14T13:19:04.297

Link: CVE-2026-89478

Redhat

Severity : Important

Publid Date: 2026-09-11T19:43:34Z

Links: CVE-2026-89478 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T23:00:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object