CVE-2026-89479 - Vulnerability Details

- sctp: stop processing a packet once its association is deleted

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: stop processing a packet once its association is deleted

sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is
NULL, and caches the result in chunk->asoc and chunk->transport without
taking a reference.

A packet that matches no association is handed to the endpoint, so a peer
can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The
COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and
with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(),
so the association and its transports are freed.

The endpoint loop has no counterpart to the asoc->base.dead check in
sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed
transport and is then passed to sctp_do_sm() with the freed association.
The transport is freed through RCU, so this needs the packet to come off
the socket backlog, where the loop runs in task context.

The endpoint loop cannot do the same check: it holds no reference on the
association, so reading asoc->base.dead would itself be a use-after-free.
Mark the packet for discard in the command interpreter, just before it
deletes the association. That is also before sctp_inq_free() releases the
chunk on the association receive path.

sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary
association, while the one the packet belongs to stays alive. A restarting
peer can bundle DATA behind its COOKIE ECHO, so compare against
chunk->asoc and leave that case alone.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel SCTP stack has a use‑after‑free bug that can be triggered by sending a, SHUTDOWN, or SHUTDOWN ACK chunk. The bug occurs when the endpoint processes a packet after its association has been freed, writing to freed memory and potentially corrupting kernel state. In the worst case an attacker can gain kernel code execution or cause a system crash by manipulating the freed data.

Affected Systems

Affected systems are Linux kernel installations that include the SCTP protocol stack, whether built‑in or via the sctp module. Systems running any Linux kernel version that contains the SCTP implementation prior to the fix are susceptible.

Risk and Exploitability

The CVSS score of 9.8 classifies the vulnerability as Critical. Its EPSS score is listed as < 1 %, indicating a low probability of exploitation, and it is not present in the CISA KEV catalog. The likely attack vector is remote: an attacker can send the malicious SCTP packets over the network to the target host. Successful exploitation would result in denial of service through a kernel crash and, if the attacker can influence the freed memory contents, arbitrary code execution at kernel level. The vulnerability requires that the attacker bundles specific SCTP chunks in a single packet, connection.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7d970353eeb98f46a3b9dc602850e4f6336a9889
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 09c3b193a3e8fe53e1f416e2f8e3283d2a785405
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ed85fe91a61bc0e0da6b585c07102b20f4cc65a0
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5c0b2dbbdafc9eeeb11fffe1e46551fc3b55d8ee
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ee3f04cf566f6041aa9a0360494fd8db5ade383a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< fa306a40e716c5abcd967475459ce1ebd56e5115
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a713e1b3a265f180ad25a08e17be15d67a2f7149
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 47e15a8d12e366d0d261bcbc394394f44418938d

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ee3f04cf566f6041aa9a0360494fd8db5ade383a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fa306a40e716c5abcd967475459ce1ebd56e5115)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a713e1b3a265f180ad25a08e17be15d67a2f7149)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,47e15a8d12e366d0d261bcbc394394f44418938d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that implements the SCTP use‑after‑free fix; follow the immediate update is not possible and SCTP functionality is not required, disable the SCTP protocol by unloading the sctp module or blocking port 5000 in the firewall to prevent malicious packets from reaching the kernel.
Continuously monitor kernel logs for SCTP‑related faults or unexpected crashes and apply the latest kernel update as soon as it becomes available.
Consult Linux kernel security advisories regularly to receive timely updates for the SCTP stack.

Generated by OpenCVE AI on September 15, 2026 at 22:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00734.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/09c3b193a3e8fe53e1f416e2f8e3283d2a785405
https://git.kernel.org/stable/c/47e15a8d12e366d0d261bcbc394394f44418938d
https://git.kernel.org/stable/c/5c0b2dbbdafc9eeeb11fffe1e46551fc3b55d8ee
https://git.kernel.org/stable/c/7d970353eeb98f46a3b9dc602850e4f6336a9889
https://git.kernel.org/stable/c/a713e1b3a265f180ad25a08e17be15d67a2f7149
https://git.kernel.org/stable/c/ed85fe91a61bc0e0da6b585c07102b20f4cc65a0
https://git.kernel.org/stable/c/ee3f04cf566f6041aa9a0360494fd8db5ade383a
https://git.kernel.org/stable/c/fa306a40e716c5abcd967475459ce1ebd56e5115
https://nvd.nist.gov/vuln/detail/CVE-2026-89479
https://www.cve.org/CVERecord?id=CVE-2026-89479

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/09c3b193a3e8fe53e1f416e2f8e3283d2a785405 https://git.kernel.org/stable/c/5c0b2dbbdafc9eeeb11fffe1e46551fc3b55d8ee https://git.kernel.org/stable/c/7d970353eeb98f46a3b9dc602850e4f6336a9889 https://git.kernel.org/stable/c/ed85fe91a61bc0e0da6b585c07102b20f4cc65a0

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89479 https://www.cve.org/CVERecord?id=CVE-2026-89479
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference. A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(), so the association and its transports are freed. The endpoint loop has no counterpart to the asoc->base.dead check in sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed transport and is then passed to sctp_do_sm() with the freed association. The transport is freed through RCU, so this needs the packet to come off the socket backlog, where the loop runs in task context. The endpoint loop cannot do the same check: it holds no reference on the association, so reading asoc->base.dead would itself be a use-after-free. Mark the packet for discard in the command interpreter, just before it deletes the association. That is also before sctp_inq_free() releases the chunk on the association receive path. sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary association, while the one the packet belongs to stays alive. A restarting peer can bundle DATA behind its COOKIE ECHO, so compare against chunk->asoc and leave that case alone.
Title		sctp: stop processing a packet once its association is deleted
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/47e15a8d12e366d0d261bcbc394394f44418938d https://git.kernel.org/stable/c/a713e1b3a265f180ad25a08e17be15d67a2f7149 https://git.kernel.org/stable/c/ee3f04cf566f6041aa9a0360494fd8db5ade383a https://git.kernel.org/stable/c/fa306a40e716c5abcd967475459ce1ebd56e5115

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:35.263Z

Updated: 2026-09-14T12:00:16.005Z

Reserved: 2026-09-11T19:38:34.711Z

Link: CVE-2026-89479

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:29.337

Modified: 2026-09-14T13:19:04.457

Link: CVE-2026-89479

Redhat

Severity : Important

Publid Date: 2026-09-11T19:43:35Z

Links: CVE-2026-89479 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T23:00:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object