CVE-2026-89477

A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. This vulnerability occurs when the kernel attempts to complete a stream reconfiguration request that has not been fully transmitted, leading to a null pointer dereference. An unprivileged local user or a remote attacker could exploit this by triggering specific stream reset or reconfiguration requests, causing the kernel to panic and resulting in a denial of service.

A NULL pointer dereference in SCTP stream reconfiguration can occur when completion handling matches a pending RECONF chunk that has been published in asoc strreset_chunk but has not yet been transmitted, leaving chunk transport as NULL. A remote SCTP peer can trigger this by sending RECONF content in an ordering where a response is processed before the pending outbound RECONF chunk has a transport assigned, for example by combining relevant RECONF parameters or chunks in one packet. This reaches timer_delete on a NULL transport pointer in softirq context and can crash the kernel (DoS). For the CVSS the PR:N is selected because the remote peer does not need local user access or privileges on the target beyond network reachability to an SCTP association. The issue is network reachable when SCTP is enabled and exposed, although SCTP services are often limited to telecom, clustering, or controlled internal networks rather than the public Internet. Impact is denial of service via kernel crash, with no demonstrated confidentiality or integrity impact from the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.