CVE-2026-89478

Received Received - Intake

Use-After-Free in Linux Kernel SCTP

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves the transport once per packet and leaves it in chunk->transport. The lookup reference, or the one sctp_add_backlog() takes if the socket is owned by userspace, keeps it around until the chunk has been processed. An authenticated ASCONF DEL-IP can remove it in the meantime. sctp_assoc_rm_peer() takes the transport out of the association and calls sctp_transport_free(), which tags it dead and drops the reference the association held. There is a window on both paths: the packet can sit on the socket backlog, and on the direct path the lookup completes before bh_lock_sock(). The DATA chunk in that packet puts the removed transport back into asoc->peer.last_data_from. Once the packet is done that reference goes away and the transport is freed by RCU, so the next delayed SACK carries the pointer into the SACK chunk and sctp_outq_select_transport() reads the freed transport's state. Drop the chunk in sctp_inq_push(), next to the existing rcvr->dead check. Both paths reach it with the association's socket lock held. The peer retransmits it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89478

EUVD

EUVD-2026-76384

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the SCTP protocol implementation. An authenticated attacker can remove a transport via ASCONF DEL-IP while a packet is still being processed, leading to a situation where a freed transport's memory is accessed later, potentially causing system instability or crashes.

Detection Guidance

This vulnerability involves the Linux kernel's SCTP protocol handling. Detection requires checking for kernel versions affected by the flaw and monitoring for related crashes or memory corruption. Commands like uname -a to check kernel version and dmesg for kernel logs may help identify issues. No specific detection commands are provided in the context.

Impact Analysis

This vulnerability could allow an authenticated attacker to cause a denial-of-service condition by crashing the system or triggering undefined behavior. Systems using SCTP for network communication may be affected if an attacker gains access to the network.

Compliance Impact

This vulnerability affects compliance with standards like GDPR and HIPAA by potentially enabling unauthorized data access or manipulation through network packet processing flaws in the Linux kernel's SCTP protocol implementation. Exploitation could lead to data breaches or integrity violations, which are critical concerns under these regulations.

Mitigation Strategies

Apply the latest kernel patches or updates that address this SCTP vulnerability. Disable SCTP if not required by your system. Monitor kernel logs for crashes or errors related to SCTP processing. Restrict network access to prevent exploitation of the ASCONF DEL-IP vector.

Hi! I’m here to help you understand CVE-2026-89478. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70