Executive brief
The Linux kernel's SCTP (Stream Control Transmission Protocol) networking module contains a use-after-free vulnerability in how it handles removed transport connections. An authenticated attacker can trigger removal of a network transport while a data packet is queued for processing, causing the kernel to later access freed memory when handling network acknowledgments. This can lead to kernel crashes or potential code execution on systems using SCTP.
Technical details
The vulnerability is a use-after-free in the SCTP inbound queue handler (sctp_inq_push()). During normal SCTP packet processing, the kernel resolves a transport reference and stores it in chunk->transport. An authenticated ASCONF DEL-IP command can remove this transport from the association and free it via sctp_transport_free(). A race condition exists where a DATA chunk queued on the socket backlog retains a pointer to the freed transport, which is then placed into asoc->peer.last_data_from. When a delayed SACK (acknowledgment) is sent, it reads the freed transport's state, causing a use-after-free. The fix adds a check in sctp_inq_push() to drop chunks if their transport reference has been marked dead, preventing the freed memory access. Authentication via ASCONF is required; the vulnerability affects all Linux kernel versions since 2.6.12.
Affected products
- Linux Linux kernel 2.6.12 and later (before patch)
Timeline
- 2026-09-11: disclosed: CVE-2026-89478 published
- 2026-08-20: patched: Patch committed upstream by Jakub Kicinski
- 2026-08-19: other: Fix authored by Hyunwoo Kim