CVE-2026-89478

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. An authenticated attacker could exploit a timing window during the removal of an SCTP transport. This could lead to the system attempting to read from freed memory, potentially causing a denial of service or information disclosure.

An SCTP use after free can occur when a packet keeps a chunk.transport pointer while an authenticated ASCONF DEL-IP removes the same transport from the association. A DATA chunk from that packet can restore the removed transport into asoc peer last_data_from, and a later delayed SACK can carry the stale pointer into transport selection where freed transport state is read. This is a network reachable race condition with AC:H because the vulnerable window depends on packet backlog or direct receive timing around socket locking and transport removal. For the CVSS the PR:N is used for the paranoid score because a remote SCTP peer may trigger the path without local code execution on the target once it can reach and form the required association. If SCTP AUTH keys or association policy restrict the peer set, PR:L is a more realistic base interpretation. Impact is at least remote denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact because the primitive is UAF in kernel networking code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.