CVE-2026-89479: Linux Kernel SCTP Use-After-Free Vulnerability

CVE-2026-89479 Overview

CVE-2026-89479 is a use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in sctp_endpoint_bh_rcv(), which caches an association pointer in chunk->asoc without taking a reference. A remote peer can bundle COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK chunks in a single packet to create, cache, and free an association within one processing loop. Subsequent chunks in the same packet then write to the freed transport and pass the freed association to sctp_do_sm(), triggering memory corruption in kernel context.

Critical Impact
A network-adjacent attacker can trigger a kernel use-after-free without authentication, enabling denial of service and potentially arbitrary kernel code execution.

Affected Products

Linux kernel (upstream stable trees, per referenced kernel.org commits)
Systems running SCTP with sockets bound to the vulnerable stack
Distributions shipping affected kernel versions prior to the backported fixes

Discovery Timeline

2026-09-11 - CVE-2026-89479 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89479

Vulnerability Analysis

The defect lives in the endpoint receive path of the Linux SCTP stack. sctp_endpoint_bh_rcv() performs an association lookup only when chunk->asoc is NULL, then caches the result in chunk->asoc and chunk->transport without incrementing a reference count. This cache assumes the association remains alive for the entire duration of the packet's chunk loop.

When a packet arrives that matches no existing association, the endpoint receives it directly. A peer can bundle a COOKIE ECHO chunk that creates a new association, a SHUTDOWN chunk that populates the endpoint's cache, and a SHUTDOWN ACK chunk that reaches sctp_sf_do_9_2_final(). With the outqueue empty, the state machine tears down the association and its transports. Because the endpoint loop lacks the asoc->base.dead guard that sctp_assoc_bh_rcv() uses, the next chunk continues processing against freed memory. It writes last_time_heard on the freed transport and passes the freed association into sctp_do_sm().

The transport is freed via RCU, so the corruption window opens once the packet reaches the socket backlog and executes in task context. This condition is a classic use-after-free triggered entirely by attacker-controlled network input.

Root Cause

The endpoint receive loop caches an association pointer without holding a reference and without checking whether the state machine has already deleted the association. The loop cannot safely re-read asoc->base.dead because doing so would itself dereference freed memory. The fix marks the packet for discard inside the command interpreter immediately before it deletes the association, stopping further chunk processing. The fix specifically compares against chunk->asoc so that sctp_sf_do_5_2_4_dupcook(), which issues SCTP_CMD_DELETE_TCB for a temporary association, does not incorrectly terminate processing of a still-live association that a restarting peer bundled DATA chunks behind its COOKIE ECHO.

Attack Vector

Exploitation requires only the ability to send crafted SCTP packets to a host with a listening SCTP socket. No authentication, user interaction, or existing association is needed because the vulnerable code path handles unmatched packets at the endpoint level. An attacker constructs a single SCTP packet bundling COOKIE ECHO, SHUTDOWN, SHUTDOWN ACK, and one or more trailing chunks. Successful exploitation corrupts kernel memory, resulting in denial of service or potentially kernel code execution depending on heap state and downstream primitives.

No public proof-of-concept has been referenced in the advisory, and no confirmed in-the-wild exploitation is reported.

Detection Methods for CVE-2026-89479

Indicators of Compromise

Unexpected kernel oops or KASAN splats referencing sctp_endpoint_bh_rcv, sctp_do_sm, or sctp_sf_do_9_2_final in system logs.
Kernel panics correlated with inbound SCTP traffic from untrusted networks.
SCTP packets containing bundled COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK chunks originating from unknown peers.

Detection Strategies

Monitor dmesg and journal entries for use-after-free reports in SCTP code paths, particularly on hosts running KASAN-enabled kernels.
Deploy network sensors to flag SCTP packets that bundle association-establishing and association-terminating chunks in a single datagram.
Correlate SCTP-related crashes with source IP reputation and packet capture metadata to distinguish exploitation from protocol errors.

Monitoring Recommendations

Enable auditing of module load events for the sctp kernel module and alert if it is loaded on hosts that do not require SCTP.
Track kernel version inventory and patch status across Linux fleets to identify hosts still exposed to CVE-2026-89479.
Ingest kernel crash telemetry into a central analytics platform and build alerts on repeated SCTP subsystem faults from a common source.

How to Mitigate CVE-2026-89479

Immediate Actions Required

Apply the upstream kernel patches referenced by the stable tree commits and reboot affected systems.
Disable the SCTP module on hosts that do not require it by blacklisting sctp in /etc/modprobe.d/.
Restrict inbound SCTP traffic at the network perimeter and host firewall to trusted peers only.

Patch Information

The fix has been merged across multiple stable branches. Refer to the upstream commits: Kernel Git Commit 09c3b19, Kernel Git Commit 47e15a8, Kernel Git Commit 5c0b2db, Kernel Git Commit 7d97035, Kernel Git Commit a713e1b, Kernel Git Commit ed85fe9, Kernel Git Commit ee3f04c, and Kernel Git Commit fa306a4. Apply the vendor kernel update that incorporates these commits for your distribution.

Workarounds

Blacklist the sctp kernel module where SCTP is not in use to eliminate the attack surface entirely.
Enforce firewall rules that drop inbound SCTP (IP protocol 132) from untrusted networks.
Where SCTP must remain enabled, restrict it to authenticated network segments and monitor for anomalous chunk bundling.

bash

# Disable the SCTP module on hosts that do not require it
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true

# Block inbound SCTP at the host firewall (nftables example)
sudo nft add rule inet filter input meta l4proto sctp drop