Vulnpedia
← Search CVEs

CVE-2026-89477

HIGH 7.5

Published 2026-09-11 · Last modified 2026-10-19

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and sctp_process_strreset_resp() complete a pending stream reconfiguration request by stopping the reconf timer on the transport it was sent on: t = asoc->strreset_chunk->transport; if (timer_delete(&t->reconf_timer)) sctp_transport_put(t); chunk->transport is assigned by __sctp_packet_append_chunk() when the chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms the reconf timer at that same point. A request already published in asoc->strreset_chunk but not yet transmitted has neither, so completing it dereferences NULL. Two ways to get there. sctp_send_asconf_del_ip() sets asoc->src_out_of_asoc_ok without sending anything when the address being removed is the association's last one, and sctp_outq_flush_ctrl() then leaves every non-ASCONF control chunk queued; as only sctp_process_asconf_ack() clears that flag, it persists. An unprivileged process that removes such an address and then asks for a stream reset panics the kernel from softirq. A peer needs neither ASCONF nor local help: sctp_cmd_interpreter() uncorks the outqueue only once the whole packet has been processed, so a reply built while walking a RECONF chunk stays untransmitted for the rest of that walk, and one RECONF chunk carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request, Response] -- or two RECONF chunks in one packet -- reaches the same dereference. KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef] RIP: 0010:timer_delete+0x67/0x110 Call Trace: <IRQ> sctp_process_strreset_addstrm_out (net/sctp/stream.c:832) sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212) sctp_do_sm (net/sctp/sm_sideeffect.c:1172) sctp_assoc_bh_rcv (net/sctp/associola.c:1044) sctp_rcv (net/sctp/input.c:243) ip_local_deliver (net/ipv4/ip_input.c:262) process_backlog (net/core/dev.c:6680) </IRQ> A response can only acknowledge a request that was actually sent, so do not match asoc->strreset_chunk while chunk->transport is NULL. Guarding the lookup covers all three completion sites.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 43rd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Linux

Products Linux

Weakness (CWE)

Not classified.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 276 vendor product statements; 244 omitted. Read the full vendor advisory.

  • kernel as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-core as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-core

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-modules-extra-matched as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-modules-extra-matched

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-rt-debug-core as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-debug-core

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-uki-virt-addons as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-uki-virt-addons

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-abi-stablelists as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-abi-stablelists

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-modules-extra as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-modules-extra

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-rt-selftests-internal as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-selftests-internal

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • bpftool as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/bpftool

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-64k-modules-core as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-64k-modules-core

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-debug-modules-partner as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug-modules-partner

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-rt-64k-debug as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-64k-debug

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-rt-64k-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-64k-modules-extra

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-rt-kvm as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-kvm

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-zfcpdump-core as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-zfcpdump-core

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/[email protected]?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9

    • none available: Affected
    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-debug as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-devel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-devel

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-headers as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-headers

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel.src as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel?arch=src

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • bpftool as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/bpftool

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-abi-whitelists as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-abi-whitelists

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-debug-devel as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug-devel

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-headers as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-headers

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-rt as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-debug-devel

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-doc

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-rt-trace-devel as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-trace-devel

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-tools as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-tools

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-tools-libs-devel

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00
  • python-perf as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/python-perf

    Red Hat · CVE-2026-89477 · Updated 2026-09-29T14:34:43+00:00

All CVSS metrics

  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS