CVE-2026-99165

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. This flaw allows a remote peer or local user to cause a denial of service (DoS) through a kernel crash. When message interleaving is enabled, the kernel drops the socket lock while waiting for association establishment or send-buffer availability, allowing handshake processing to free output stream extensions without proper revalidation. When the sending process resumes and accesses the unvalidated stream, it dereferences a null pointer, causing a system panic.

This vulnerability is evaluated as having Moderate impact because successful exploitation results in a kernel panic and host denial of service, without granting arbitrary code execution or unauthorized data exposure. Typical Red Hat Enterprise Linux configurations do not automatically load the SCTP kernel module unless an administrator explicitly loads it or an active service binds an SCTP socket. Additionally, triggering the flaw requires local unprivileged socket operations and the specific configuration of SCTP message interleaving combined with stream reconfiguration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.