Junglewise Threat Intelligence

CVE-2026-89477: Linux kernel SCTP NULL pointer dereference in stream reconfiguration

CVE-2026-89477 · Severity: high · CVSS 7.5 · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's SCTP (Stream Control Transmission Protocol) implementation contains a null pointer dereference vulnerability in stream reconfiguration handling. An attacker can trigger a kernel panic by sending specially crafted RECONF (reconfiguration) messages or by removing the last address from an SCTP association and requesting a stream reset, causing a denial of service and system crash.

Technical details

The vulnerability exists in SCTP's stream reconfiguration completion logic (sctp_process_strreset_outreq, sctp_process_strreset_addstrm_out, and sctp_process_strreset_resp functions). These functions attempt to access chunk->transport to stop a reconf timer, but when a RECONF request is queued but not yet transmitted, chunk->transport is NULL, leading to a null pointer dereference. The issue can be triggered in two ways: (1) an unprivileged local process removing the association's last address and requesting stream reset, or (2) a remote peer sending multiple RECONF chunks in one packet that trigger replies during processing before transmission. The fix involves checking that chunk->transport is not NULL before attempting to match and complete the pending request.

Affected products

  • Linux Linux kernel Affected versions prior to fix

Timeline

  • 2026-09-11: disclosed
  • other: CVE-2026-89477 assigned

Related threats