Vulnpedia
← Search CVEs

CVE-2026-89479

CRITICAL 9.8

Published 2026-09-11 · Last modified 2026-10-19

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference. A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(), so the association and its transports are freed. The endpoint loop has no counterpart to the asoc->base.dead check in sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed transport and is then passed to sctp_do_sm() with the freed association. The transport is freed through RCU, so this needs the packet to come off the socket backlog, where the loop runs in task context. The endpoint loop cannot do the same check: it holds no reference on the association, so reading asoc->base.dead would itself be a use-after-free. Mark the packet for discard in the command interpreter, just before it deletes the association. That is also before sctp_inq_free() releases the chunk on the association receive path. sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary association, while the one the packet belongs to stays alive. A restarting peer can bundle DATA behind its COOKIE ECHO, so compare against chunk->asoc and leave that case alone.

ELEVATED IMPACT

Severe if exploited (CVSS 9.8), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 43rd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

9.8CVSS 3.1 · CRITICAL

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Linux

Products Linux

Weakness (CWE)

Not classified.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 379 vendor product statements; 347 omitted. Read the full vendor advisory.

  • bpftool-0:4.18.0-553.176.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-core-0:4.18.0-553.176.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-debug-devel-0:4.18.0-553.176.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-debuginfo-0:4.18.0-553.176.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-modules-extra-0:4.18.0-553.176.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-zfcpdump-0:4.18.0-553.176.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • python3-perf-0:4.18.0-553.176.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-debuginfo-0:4.18.0-553.176.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • python3-perf-debuginfo-0:4.18.0-553.176.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-rt-modules-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-rt-modules-extra-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-debug-modules as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug-modules

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-rt-64k-modules as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-64k-modules

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-zfcpdump as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-zfcpdump

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-kdump as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-kdump

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-64k as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-64k

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-debug as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-rt-64k as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-64k

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-rt-debug as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-debug

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-tools-libs as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-tools-libs

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/[email protected]?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9

    • none available: Affected
    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel

    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-abi-whitelists as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-abi-whitelists

    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-debug as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug

    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-debug-devel as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug-devel

    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-doc as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-doc

    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-firmware as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-firmware

    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-kdump as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-kdump

    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • kernel-kdump-devel as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-kdump-devel

    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • perf as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/perf

    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00
  • python-perf as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-perf

    Red Hat · CVE-2026-89479 · Updated 2026-10-20T04:32:41+00:00

All CVSS metrics

  • CRITICAL 9.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CRITICAL 9.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS