CVE-2026-23125

A NULL pointer dereference flaw was found in the Linux kernel's SCTP implementation. When SCTP-AUTH key initialization fails during INIT_ACK processing, the association's shared key (asoc->shkey) remains NULL while authentication capability flags are already set. If a DATA chunk is subsequently queued and transmitted with the COOKIE_ECHO, sctp_packet_bundle_auth() dereferences the NULL shkey pointer, causing a kernel crash.

Exploitation requires an SCTP association using authentication where the shared key initialization fails due to resource constraints or other errors. While this can be triggered via network traffic during connection establishment, it requires specific failure conditions to occur during INIT_ACK processing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the sctp module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist kernel modules.