CVE-2026-89478
A flaw in the Linux kernel’s SCTP (Stream Control Transmission Protocol) handling can let an attacker send specially crafted packets that cause the kernel to crash or become unresponsive. The bug involves a race condition where a removed transport is still referenced, leading to a use‑after‑free. The issue has been fixed in the kernel, but no specific version or patch is listed in the provided sources.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Linux kernel users that have SCTP enabled, including servers and devices running any recent Linux distribution that includes the kernel’s SCTP implementation.
Real-world impact
An attacker could send malicious SCTP packets to a target system, causing the kernel to crash or become unstable, effectively denying service to legitimate users.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network (AV:N), requires no authentication (PR:N), has no user interaction (UI:N), and can lead to complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources