Executive brief
The Linux kernel's SCTP (Stream Control Transmission Protocol) implementation contains a use-after-free vulnerability in packet processing that can be triggered when associations are deleted during packet handling. An attacker can craft a malicious packet sequence to cause the kernel to read from and write to freed memory, potentially leading to system crash or code execution. This affects systems running vulnerable Linux kernel versions that handle SCTP network traffic.
Technical details
The vulnerability exists in sctp_endpoint_bh_rcv() where association references are cached in chunk structures without proper reference counting. When a peer bundles COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK in a single packet, the COOKIE ECHO creates an association, SHUTDOWN caches it, and SHUTDOWN ACK triggers deletion through sctp_sf_do_9_2_final(). However, the endpoint receive loop lacks the asoc->base.dead check present in sctp_assoc_bh_rcv(), allowing subsequent chunks to access freed transport and association structures. The attack requires network-level packet crafting but no authentication, and the fix marks packets for discard in the command interpreter before association deletion to prevent use-after-free.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed