Executive brief
The Linux kernel's SCTP (Stream Control Transmission Protocol) implementation contains a null pointer dereference vulnerability in stream reconfiguration handling. An attacker can trigger a kernel panic by sending specially crafted RECONF (reconfiguration) messages or by removing the last address from an SCTP association and requesting a stream reset, causing a denial of service and system crash.
Technical details
The vulnerability exists in SCTP's stream reconfiguration completion logic (sctp_process_strreset_outreq, sctp_process_strreset_addstrm_out, and sctp_process_strreset_resp functions). These functions attempt to access chunk->transport to stop a reconf timer, but when a RECONF request is queued but not yet transmitted, chunk->transport is NULL, leading to a null pointer dereference. The issue can be triggered in two ways: (1) an unprivileged local process removing the association's last address and requesting stream reset, or (2) a remote peer sending multiple RECONF chunks in one packet that trigger replies during processing before transmission. The fix involves checking that chunk->transport is not NULL before attempting to match and complete the pending request.
Affected products
- Linux Linux kernel Affected versions prior to fix
Timeline
- 2026-09-11: disclosed
- other: CVE-2026-89477 assigned