CVE-2026-89479

Received Received - Intake

Use-After-Free in Linux Kernel SCTP Implementation

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference. A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(), so the association and its transports are freed. The endpoint loop has no counterpart to the asoc->base.dead check in sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed transport and is then passed to sctp_do_sm() with the freed association. The transport is freed through RCU, so this needs the packet to come off the socket backlog, where the loop runs in task context. The endpoint loop cannot do the same check: it holds no reference on the association, so reading asoc->base.dead would itself be a use-after-free. Mark the packet for discard in the command interpreter, just before it deletes the association. That is also before sctp_inq_free() releases the chunk on the association receive path. sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary association, while the one the packet belongs to stays alive. A restarting peer can bundle DATA behind its COOKIE ECHO, so compare against chunk->asoc and leave that case alone.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89479

EUVD

EUVD-2026-76385

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the SCTP (Stream Control Transmission Protocol) implementation. A packet can be crafted to bundle multiple SCTP chunks (COOKIE ECHO, SHUTDOWN, SHUTDOWN ACK) in a way that deletes an association while still processing the packet. This leads to a use-after-free scenario where freed memory is accessed, potentially causing system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCTP implementation. Detection primarily involves checking kernel version and SCTP module behavior. Use 'uname -a' to check kernel version and 'lsmod | grep sctp' to verify if SCTP module is loaded. Monitor kernel logs for SCTP-related errors or crashes.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (DoS) condition by crashing the system or triggering undefined behavior. If exploited, it may lead to kernel memory corruption, system instability, or potential privilege escalation, depending on the system configuration and kernel version.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If immediate patching is not possible, consider disabling the SCTP module using 'modprobe -r sctp' or blacklisting it in '/etc/modprobe.d/'. Monitor network traffic for unusual SCTP packet patterns that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-89479. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70