CVE-2026-89478: Linux Kernel SCTP Privilege Escalation

CVE-2026-89478 Overview

CVE-2026-89478 is a use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw exists in the packet reception path where sctp_rcv() resolves a transport once per packet and stores it in chunk->transport. An authenticated ASCONF DEL-IP chunk can remove that transport concurrently, freeing it while it is still referenced by an in-flight DATA chunk and subsequent SACK processing.

Critical Impact
A remote attacker able to send authenticated SCTP ASCONF chunks can trigger a use-after-free in sctp_outq_select_transport(), leading to kernel memory corruption, denial of service, or potential remote code execution in kernel context.

Affected Products

Linux kernel SCTP subsystem (multiple stable branches, per referenced git commits)
Distributions shipping vulnerable Linux kernel versions prior to the fix
Systems with SCTP enabled and reachable over the network

Discovery Timeline

2026-09-11 - CVE-2026-89478 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89478

Vulnerability Analysis

The vulnerability resides in the SCTP receive path. When sctp_rcv() processes an incoming packet, it performs a transport lookup and caches the pointer in chunk->transport. The lookup reference, or the reference taken by sctp_add_backlog() when the socket is owned by user space, keeps the transport alive for the duration of chunk processing.

An authenticated ASCONF DEL-IP request can remove the peer address between lookup and processing. sctp_assoc_rm_peer() detaches the transport from the association and calls sctp_transport_free(), which marks it dead and drops the association's reference. A race window exists on two paths: the packet may sit on the socket backlog, or on the direct path the lookup completes before bh_lock_sock() is acquired.

When the DATA chunk in that packet is processed, it stores the now-removed transport pointer into asoc->peer.last_data_from. Once the current packet completes, the last reference is dropped and RCU frees the transport. The next delayed SACK carries the stale pointer into the SACK chunk, and sctp_outq_select_transport() then reads freed memory.

Root Cause

The root cause is a lifecycle mismatch between transport references held for packet processing and asynchronous removal via ASCONF DEL-IP. The association-level removal does not account for chunks already resolved to that transport, allowing a use-after-free once RCU reclaims the object.

Attack Vector

An attacker with an authenticated SCTP association can send an ASCONF DEL-IP chunk to remove a peer address while a DATA chunk targeting the same transport is in flight or queued on the socket backlog. The subsequent SACK generation dereferences the freed transport. The fix drops the affected chunk in sctp_inq_push() alongside the existing rcvr->dead check, with the peer responsible for retransmission.

// No verified exploit code is available. See kernel commit references
// for the corrective patch: sctp: drop a chunk if its transport was removed

Detection Methods for CVE-2026-89478

Indicators of Compromise

Kernel oops or panic messages referencing sctp_outq_select_transport, sctp_assoc_rm_peer, or sctp_transport_free in dmesg or /var/log/kern.log.
KASAN use-after-free reports involving SCTP transport objects on kernels built with sanitizers enabled.
Unexpected SCTP association resets or repeated peer retransmissions correlated with ASCONF activity.

Detection Strategies

Monitor kernel crash telemetry for SCTP-related stack traces and correlate with recent SCTP peer address changes.
Inspect network captures for authenticated ASCONF chunks containing DEL-IP parameters from unexpected sources.
Alert on repeated ASCONF DEL-IP requests targeting active associations, especially interleaved with DATA traffic.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized analytics platform for correlation with SCTP peer events.
Track SCTP protocol counters (/proc/net/sctp/snmp) for abnormal SACK or ASCONF rates.
Baseline legitimate ASCONF usage in telecom and signaling workloads to surface anomalous DEL-IP traffic.

How to Mitigate CVE-2026-89478

Immediate Actions Required

Apply the upstream Linux kernel patch that drops chunks whose transport has been removed, as shipped in the referenced stable commits.
Prioritize patching hosts that expose SCTP on untrusted networks, including telecom signaling gateways and Diameter/M3UA endpoints.
If patching is not immediate, restrict SCTP peers to trusted endpoints via firewall rules and network segmentation.

Patch Information

The fix drops the chunk in sctp_inq_push() next to the existing rcvr->dead check, ensuring both the backlog and direct receive paths reach it with the association's socket lock held. The peer retransmits the dropped chunk. Corrective commits are available at Kernel Git Commit 03a9d10e, Kernel Git Commit 0422b092, Kernel Git Commit 1035bdef, Kernel Git Commit 3537961d, Kernel Git Commit 3fc072e7, Kernel Git Commit 928fd792, Kernel Git Commit c6c86a5e, and Kernel Git Commit d7cb5ad8.

Workarounds

Unload the sctp kernel module on systems that do not require SCTP: modprobe -r sctp and blacklist it.
Block inbound SCTP (IP protocol 132) at perimeter firewalls where the service is not required.
Constrain SCTP endpoints to authenticated peers on isolated management networks until patches are deployed.

bash

# Blacklist the SCTP module where not required
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/blacklist-sctp.conf
sudo modprobe -r sctp

# Drop inbound SCTP at the host firewall
sudo iptables -A INPUT -p 132 -j DROP