CVE-2026-23125: Linux Kernel Privilege Escalation Flaw

CVE-2026-23125 Overview

CVE-2026-23125 is a null pointer dereference [CWE-476] in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in the SCTP-AUTH key initialization path within net/sctp/output.c and net/sctp/sm_sideeffect.c. When sctp_auth_asoc_init_active_key() fails during INIT_ACK processing in sctp_sf_do_5_1C_ack(), the association's shkey remains NULL while peer.auth_capable and peer.peer_chunks are already set. A subsequent DATA chunk transmitted alongside a queued COOKIE_ECHO triggers a kernel crash in sctp_packet_bundle_auth().

Critical Impact
A local attacker with low privileges can trigger a kernel-level null pointer dereference, causing a denial-of-service condition through a kernel panic on systems using SCTP with authentication enabled.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Linux Kernel 6.19 release candidates rc1 through rc6
Distributions shipping vulnerable SCTP module with SCTP-AUTH enabled

Discovery Timeline

2026-02-14 - CVE-2026-23125 published to the National Vulnerability Database
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23125

Vulnerability Analysis

The vulnerability stems from an ordering issue in the SCTP state machine command interpreter. When the kernel processes an INIT_ACK chunk, it executes a sequence of commands including SCTP_CMD_PEER_INIT, SCTP_CMD_TIMER_STOP (T1_INIT), SCTP_CMD_TIMER_START (T1_COOKIE), SCTP_CMD_NEW_STATE, SCTP_CMD_ASSOC_SHKEY, and SCTP_CMD_GEN_COOKIE_ECHO. The SCTP_CMD_ASSOC_SHKEY command initializes the shared authentication key required for authenticated chunks.

If sctp_auth_asoc_init_active_key() fails, command interpretation halts and SCTP_CMD_GEN_COOKIE_ECHO never executes. However, the T1_COOKIE timer started earlier may later enqueue a COOKIE_ECHO chunk. The association now has authentication capability advertised by the peer but no valid shared key. A DATA chunk authored with auth = 1 and shkey = NULL becomes eligible for transmission. KASAN captures the resulting null pointer dereference in the range [0x18-0x1f] at sctp_packet_bundle_auth net/sctp/output.c:264.

Root Cause

The root cause is incorrect ordering of state machine commands. The SCTP_CMD_ASSOC_SHKEY operation runs after timers have already been mutated, leaving the association in an inconsistent state when key derivation fails. The asoc->shkey pointer remains NULL while authentication parameters indicate authenticated DATA is permissible.

Attack Vector

A local user holding an SCTP socket can trigger the failure path by inducing memory pressure or specific INIT_ACK conditions that cause sctp_auth_asoc_init_active_key() to return an error. The transmit path then dereferences the null shkey inside sctp_packet_append_chunk(), producing a kernel panic. Exploitation does not require remote network access; the CVSS vector indicates a local attack vector with no user interaction needed.

No public exploit, proof-of-concept, or CISA KEV listing is associated with this CVE. The condition reproduces under fault injection or stress scenarios that force key initialization to fail.

Detection Methods for CVE-2026-23125

Indicators of Compromise

Kernel panic messages referencing sctp_packet_bundle_auth or sctp_packet_append_chunk in dmesg or /var/log/kern.log
KASAN reports flagging null pointer dereferences in the address range [0x18-0x1f] within SCTP code paths
Unexpected reboots or ksoftirqd crashes on hosts running SCTP services such as Diameter, M3UA, or telephony signaling stacks

Detection Strategies

Inventory hosts loading the sctp kernel module via lsmod | grep sctp and correlate with kernel version data
Audit kernel versions against the patched commits referenced in the kernel.org stable tree to identify unpatched systems
Capture kernel crash dumps with kdump and inspect for SCTP-AUTH related call stacks

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on BUG:, KASAN, or null-ptr-deref strings tied to SCTP symbols
Monitor systemd systemd-coredump events and unplanned host restarts on SCTP-enabled servers
Track package update compliance for linux-image packages across telecom, carrier-grade, and signaling infrastructure

How to Mitigate CVE-2026-23125

Immediate Actions Required

Apply the upstream Linux kernel patches that move SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT, before timer operations
Update to a distribution kernel that includes the fix; consult distribution security trackers for backported package versions
Restrict local user access on systems exposing SCTP sockets to reduce the local attack surface

Patch Information

The fix relocates SCTP_CMD_ASSOC_SHKEY to run immediately after SCTP_CMD_PEER_INIT and before stopping T1_INIT or starting T1_COOKIE. If key generation fails, the association cannot transmit authenticated DATA, and the T1_INIT timer permits the client to retry. Reference the upstream commits: Linux Kernel Commit 0c4adb1, Linux Kernel Commit 5a309be, Linux Kernel Commit 784428a, Linux Kernel Commit a80c9d9, Linux Kernel Commit bf2b543, Linux Kernel Commit e7e81ab, and Linux Kernel Commit e942947.

Workarounds

Disable the SCTP module on hosts that do not require SCTP by blacklisting it in /etc/modprobe.d/
Disable SCTP-AUTH on affected associations where operationally acceptable to avoid the vulnerable code path
Limit untrusted local accounts on systems that must run SCTP services until kernel updates are deployed

bash

# Configuration example: blacklist SCTP module on systems that do not require it
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep sctp

# Check running kernel version against patched releases
uname -r