CVE-2026-89479: sctp: stop processing a packet once its association is deleted
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.5%
EPSS score, percentile 42.7 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 9.8 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- 2.6.12
Unaffected before 2.6.12; 5.10.270; 5.15.221; 6.1.188; 6.6.157; 6.12.109; and 3 more
Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
What to do
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | from 1da177e4c3f4 to before 7d970353eeb9 |
| Affected | from 1da177e4c3f4 to before 09c3b193a3e8 |
| Affected | from 1da177e4c3f4 to before ed85fe91a61b |
| Affected | from 1da177e4c3f4 to before 5c0b2dbbdafc |
| Affected | from 1da177e4c3f4 to before ee3f04cf566f |
| Affected | from 1da177e4c3f4 to before fa306a40e716 |
| Affected | from 1da177e4c3f4 to before a713e1b3a265 |
| Affected | from 1da177e4c3f4 to before 47e15a8d12e3 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | 2.6.12 |
| Unaffected | before 2.6.12 |
| Unaffected | 5.10.270 |
| Unaffected | 5.15.221 |
| Unaffected | 6.1.188 |
| Unaffected | 6.6.157 |
| Unaffected | 6.12.109 |
| Unaffected | 6.18.50 |
| Unaffected | 7.2.4 |
| Unaffected | 7.3 |
Versions not listed are: affected.
Versions the record lists as unaffected: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3.
Source: CVE List, as of . About the data.
About this vulnerability
In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference. A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SH…
Summary: CVE record, as of .
- CISA has not added CVE-2026-89479 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
- The CVE record was published on 11 Sep 2026.
- The CVE record carries a CVSS v3.1 base score of 9.8 (Critical), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.5% (percentile 42.7), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
- CISA's SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact total.
Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.
Description
sctp: stop processing a packet once its association is deleted
In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference. A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(), so the association and its transports are freed. The endpoint loop has no counterpart to the asoc->base.dead check in sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed transport and is then passed to sctp_do_sm() with the freed association. The transport is freed through RCU, so this needs the packet to come off the socket backlog, where the loop runs in task context. The endpoint loop cannot do the same check: it holds no reference on the association, so reading asoc->base.dead would itself be a use-after-free. Mark the packet for discard in the command interpreter, just before it deletes the association. That is also before sctp_inq_free() releases the chunk on the association receive path. sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary association, while the one the packet belongs to stays alive. A restarting peer can bundle DATA behind its COOKIE ECHO, so compare against chunk->asoc and leave that case alone.
Source: CVE List, as of . About the data.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
8
Known exploited Linux vulnerabilities
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- CVE-2025-39964: Linux Kernel Race Condition Vulnerability
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2026-53362: Linux Kernel Unspecified Vulnerability