CVE-2026-89476: Linux Kernel SCTP Privilege Escalation Flaw

CVE-2026-89476 Overview

CVE-2026-89476 is a Linux kernel vulnerability in the Stream Control Transmission Protocol (SCTP) implementation. The flaw allows an integer underflow of the stream->outcnt counter when duplicate RECONF (Reconfiguration) chunk responses are processed. A cached RECONF chunk may contain more than one request parameter, so a duplicate response can process the same ADD_OUT request while another parameter remains outstanding. This rolls back outcnt twice and can cause it to underflow.

The upstream fix tracks outstanding request types as bits and clears each bit after its first response, causing later responses for the same request to be ignored.

Critical Impact
A remote peer capable of sending crafted duplicate SCTP RECONF responses can trigger kernel state corruption and denial of service on affected Linux systems.

Affected Products

Linux kernel — SCTP subsystem (net/sctp/stream.c reconfiguration handling)
Distributions shipping vulnerable kernel versions prior to the referenced stable backports
Systems where SCTP is loaded or exposed on the network

Discovery Timeline

2026-09-11 - CVE-2026-89476 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89476

Vulnerability Analysis

The defect lives in the Linux kernel SCTP stream reconfiguration logic. RECONF chunks negotiate stream changes between SCTP peers, and a single cached RECONF chunk can carry multiple request parameters such as ADD_OUT. When the peer sends a response, the kernel matches the response to the cached request and decrements stream->outcnt to roll back the pending change.

Before the fix, the code did not mark individual parameters as answered. A duplicate response arriving while other parameters were still outstanding matched the same ADD_OUT request again. The kernel then executed the rollback twice, decrementing outcnt beyond its correct value. Because outcnt is an unsigned counter, a second decrement below zero wraps to a very large value, corrupting stream accounting used elsewhere in the SCTP stack.

Root Cause

The root cause is missing deduplication of response processing for parameters inside a cached RECONF chunk. The kernel treated each response independently rather than tracking which request parameters had already been resolved. This is an integer underflow driven by a logic flaw in state tracking rather than a bounds-check bug in a single arithmetic operation.

Attack Vector

Exploitation requires a network-reachable SCTP association with the target. An attacker acting as the SCTP peer sends duplicate RECONF response parameters that reference an ADD_OUT request still cached by the victim. No authentication or user interaction is required, and the vulnerability affects availability by corrupting stream counters and destabilizing the SCTP endpoint.

No public exploit code is available. Technical details are documented in the upstream stable patches, including 041f7df5a929, 092acd3c55a4, 2d867663c563, 3faf13aff243, 59f61c39cb99, 793519e34386, 8320cbd81bc2, and d02a5794c3de.

Detection Methods for CVE-2026-89476

Indicators of Compromise

Unexpected kernel warnings or oopses originating from net/sctp/stream.c or nearby SCTP reconfiguration functions.
SCTP associations exhibiting inconsistent outgoing stream counts or repeated RECONF renegotiation failures.
Kernel panics or soft lockups on hosts running SCTP services such as telecom signaling gateways (Diameter, SIGTRAN) shortly after peer reconnection.

Detection Strategies

Compare the running kernel version and vendor build against the fixed commits listed in the upstream stable references.
Monitor SCTP peers that repeatedly send RECONF response parameters targeting the same request within a short window.
Enable kernel address sanitizer builds in test environments to catch counter corruption early during fuzz testing of SCTP.

Monitoring Recommendations

Forward kernel logs (dmesg, journalctl -k) to a centralized log store and alert on SCTP-related stack traces.
Baseline SCTP association counters via ss --sctp or /proc/net/sctp and alert on sudden anomalies in stream counts.
Track network flows on SCTP ports at perimeter and internal boundaries to identify unexpected peers issuing reconfiguration traffic.

How to Mitigate CVE-2026-89476

Immediate Actions Required

Apply the vendor kernel update that includes the upstream fix tracking outstanding RECONF request types as bits.
Inventory hosts with SCTP loaded (lsmod | grep sctp) and prioritize patching those exposing SCTP to untrusted networks.
If patching cannot be scheduled immediately, restrict SCTP peer reachability to trusted endpoints using host and network firewalls.

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Reference commits include Kernel Patch 041f7df, Kernel Patch 092acd3, Kernel Patch 2d86766, Kernel Patch 3faf13a, Kernel Patch 59f61c3, Kernel Patch 793519e, Kernel Patch 8320cbd, and Kernel Patch d02a579. Consult your distribution's advisory to identify the corresponding backported release.

Workarounds

Blacklist the SCTP module on systems that do not require it by adding blacklist sctp to a file under /etc/modprobe.d/ and rebooting.
Filter inbound SCTP traffic (IP protocol 132) at network boundaries and on hosts using iptables/nftables rules that permit only known peers.
Segment SCTP-dependent workloads such as telecom signaling nodes into dedicated networks with strict peer allowlists.

bash

# Configuration example: prevent the SCTP module from loading
echo 'install sctp /bin/true' | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true

# Verify SCTP is not loaded
lsmod | grep -i sctp || echo "sctp module not loaded"