CVE-2026-89479

sctp: stop processing a packet once its association is deleted

Published Sep 11, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: stop processing a packet once its association is deleted

sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is
NULL, and caches the result in chunk->asoc and chunk->transport without
taking a reference.

A packet that matches no association is handed to the endpoint, so a peer
can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The
COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and
with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(),
so the association and its transports are freed.

The endpoint loop has no counterpart to the asoc->base.dead check in
sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed
transport and is then passed to sctp_do_sm() with the freed association.
The transport is freed through RCU, so this needs the packet to come off
the socket backlog, where the loop runs in task context.

The endpoint loop cannot do the same check: it holds no reference on the
association, so reading asoc->base.dead would itself be a use-after-free.
Mark the packet for discard in the command interpreter, just before it
deletes the association. That is also before sctp_inq_free() releases the
chunk on the association receive path.

sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary
association, while the one the packet belongs to stays alive. A restarting
peer can bundle DATA behind its COOKIE ECHO, so compare against
chunk->asoc and leave that case alone.

Analysis

Technical impact

The Linux kernel SCTP stack has a use‑after‑free bug that can be triggered by sending a, SHUTDOWN, or SHUTDOWN ACK chunk. The bug occurs when the endpoint processes a packet after its association has been freed, writing to freed memory and potentially corrupting kernel state. In the worst case an attacker can gain kernel code execution or cause a system crash by manipulating the freed data.

Affected Systems

Affected systems are Linux kernel installations that include the SCTP protocol stack, whether built‑in or via the sctp module. Systems running any Linux kernel version that contains the SCTP implementation prior to the fix are susceptible.

Risk and Exploitability

The CVSS score of 9.8 classifies the vulnerability as Critical. Its EPSS score is listed as < 1 %, indicating a low probability of exploitation, and it is not present in the CISA KEV catalog. The likely attack vector is remote: an attacker can send the malicious SCTP packets over the network to the target host. Successful exploitation would result in denial of service through a kernel crash and, if the attacker can influence the freed memory contents, arbitrary code execution at kernel level. The vulnerability requires that the attacker bundles specific SCTP chunks in a single packet, connection.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7d970353eeb98f46a3b9dc602850e4f6336a9889
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 09c3b193a3e8fe53e1f416e2f8e3283d2a785405
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ed85fe91a61bc0e0da6b585c07102b20f4cc65a0
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5c0b2dbbdafc9eeeb11fffe1e46551fc3b55d8ee
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ee3f04cf566f6041aa9a0360494fd8db5ade383a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< fa306a40e716c5abcd967475459ce1ebd56e5115
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a713e1b3a265f180ad25a08e17be15d67a2f7149
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 47e15a8d12e366d0d261bcbc394394f44418938d

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ee3f04cf566f6041aa9a0360494fd8db5ade383a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fa306a40e716c5abcd967475459ce1ebd56e5115)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a713e1b3a265f180ad25a08e17be15d67a2f7149)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,47e15a8d12e366d0d261bcbc394394f44418938d)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that implements the SCTP use‑after‑free fix; follow the immediate update is not possible and SCTP functionality is not required, disable the SCTP protocol by unloading the sctp module or blocking port 5000 in the firewall to prevent malicious packets from reaching the kernel.
Continuously monitor kernel logs for SCTP‑related faults or unexpected crashes and apply the latest kernel update as soon as it becomes available.
Consult Linux kernel security advisories regularly to receive timely updates for the SCTP stack.

Generated by OpenCVE AI on September 15, 2026 at 22:47 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.500% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/09c3b193a3e8fe53e1f416e2f8e3283d2a785405
https://git.kernel.org/stable/c/47e15a8d12e366d0d261bcbc394394f44418938d
https://git.kernel.org/stable/c/5c0b2dbbdafc9eeeb11fffe1e46551fc3b55d8ee
https://git.kernel.org/stable/c/7d970353eeb98f46a3b9dc602850e4f6336a9889
https://git.kernel.org/stable/c/a713e1b3a265f180ad25a08e17be15d67a2f7149
https://git.kernel.org/stable/c/ed85fe91a61bc0e0da6b585c07102b20f4cc65a0
https://git.kernel.org/stable/c/ee3f04cf566f6041aa9a0360494fd8db5ade383a
https://git.kernel.org/stable/c/fa306a40e716c5abcd967475459ce1ebd56e5115
https://nvd.nist.gov/vuln/detail/CVE-2026-89479
https://www.cve.org/CVERecord?id=CVE-2026-89479

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/09c3b193a3e8fe53e1f416e2f8e3283d2a785405 https://git.kernel.org/stable/c/5c0b2dbbdafc9eeeb11fffe1e46551fc3b55d8ee https://git.kernel.org/stable/c/7d970353eeb98f46a3b9dc602850e4f6336a9889 https://git.kernel.org/stable/c/ed85fe91a61bc0e0da6b585c07102b20f4cc65a0

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89479 https://www.cve.org/CVERecord?id=CVE-2026-89479
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference. A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(), so the association and its transports are freed. The endpoint loop has no counterpart to the asoc->base.dead check in sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed transport and is then passed to sctp_do_sm() with the freed association. The transport is freed through RCU, so this needs the packet to come off the socket backlog, where the loop runs in task context. The endpoint loop cannot do the same check: it holds no reference on the association, so reading asoc->base.dead would itself be a use-after-free. Mark the packet for discard in the command interpreter, just before it deletes the association. That is also before sctp_inq_free() releases the chunk on the association receive path. sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary association, while the one the packet belongs to stays alive. A restarting peer can bundle DATA behind its COOKIE ECHO, so compare against chunk->asoc and leave that case alone.
Title		sctp: stop processing a packet once its association is deleted
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/47e15a8d12e366d0d261bcbc394394f44418938d https://git.kernel.org/stable/c/a713e1b3a265f180ad25a08e17be15d67a2f7149 https://git.kernel.org/stable/c/ee3f04cf566f6041aa9a0360494fd8db5ade383a https://git.kernel.org/stable/c/fa306a40e716c5abcd967475459ce1ebd56e5115