Executive brief
The Linux kernel's SCTP (Stream Control Transmission Protocol) module handles stream reconfiguration requests used in network communication protocols. A flaw in handling duplicate reconfiguration responses can cause an integer underflow in internal stream counters, potentially leading to kernel memory corruption or a denial-of-service crash on systems using SCTP.
Technical details
The vulnerability is an integer underflow (CWE-191) in the SCTP stream reconfiguration handler. When a cached RECONF chunk contains multiple request parameters, a duplicate response can trigger processing of the same ADD_OUT request twice, decrementing the stream->outcnt counter twice and causing an underflow. The attack vector is network-based and requires the attacker to send malformed or duplicate RECONF response packets to an SCTP endpoint. No authentication is required. The fix changes the tracking mechanism from a simple counter to a bitmask, ensuring each request type is only processed once regardless of duplicate responses. Patches have been committed to stable kernel branches.
Affected products
- Linux Linux kernel all versions supporting SCTP (introduced in 11ae76e67a17)
Timeline
- 2026-09-11: disclosed: Published in NVD
- 2026-09-14: patched: Patch committed to stable kernel branches by Greg Kroah-Hartman