229 matches found
kernel: sctp: clear new_transport when removing a peer
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An authenticated remote SCTP peer can trigger a use-after-free vulnerability by adding and then immediately removing a transport within the same ASCONF chunk. This can lead to a system crash, resultin...
kernel: sctp: clear new_transport when removing a peer
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An authenticated remote SCTP peer can trigger a use-after-free vulnerability by adding and then immediately removing a transport within the same ASCONF chunk. This can lead to a system crash, resultin...
kernel: sctp: clear new_transport when removing a peer
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An authenticated remote SCTP peer can trigger a use-after-free vulnerability by adding and then immediately removing a transport within the same ASCONF chunk. This can lead to a system crash, resultin...
kernel: sctp: clear new_transport when removing a peer
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An authenticated remote SCTP peer can trigger a use-after-free vulnerability by adding and then immediately removing a transport within the same ASCONF chunk. This can lead to a system crash, resultin...
sctphantom
SCTPhantom — Linux kernel SCTP ASCONF use-after-free tracking site Source for the SCTPhantom patch-status tracker: a single-page site recording which distributions have shipped a fix for the SCTP ASCONF transport use-after-free in the Linux kernel. Where the facts live Everything about the bug —...
CVE-2026-74586
CVE-2026-74586 — SCTP ASCONF newtransport use-after-free trigger A self-contained, unprivileged PoC for CVE-2026-74586, a use-after-free in the Linux kernel's SCTP ASCONF dynamic address reconfiguration handling. Credit for the bug itself goes to Qing Ming, who reported it upstream; the fix is...
CVE-2026-64564
CVE-2026-64564 — SCTPhantom: Linux SCTP ASCONF DEL-IP UAF Local Privilege Escalation HackSpeak distribution repository. This repository is a distribution mirror of a community-public PoC; the code is identical to upstream. ⚠️ Upstream provides no LICENSE and no author information; this PoC is...
CVE-2026-64564
Debian 13 6.12.95 SCTP ASCONF DEL-IP UAF proof of concept. gcc -O2 -static -o lpe lpedebian.6.12.95.c ./lpe...
SUSE CVE-2026-99128
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...
AZL-111239 CVE-2026-99128 affecting package kernel for versions less than 6.6.161.1-1
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...
DEBIAN-CVE-2026-99128
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...
CVE-2026-99128
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...
UBUNTU-CVE-2026-99128
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...
CVE-2026-99128 sctp: validate chunk length in the inqueue parser
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...
CVE-2026-99128 sctp: validate chunk length in the inqueue parser
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...
CVE-2026-99128
The Linux kernel contains a vulnerability in the SCTP stack where sctp_inq_pop() accepts chunks with declared lengths shorter than the required four-byte generic header. A remote SCTP peer can trigger a receive softirq lockup by sending a zero-length ASCONF chunk. This is exploitable on kernels c...
EUVD-2026-111880
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...
PT-2026-128121
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctp inq pop currently accepts shorter declared lengths. A zero-length chunk leaves chunk end at the current header. Whe...
CVE-2026-99128
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...
Linux Distros Unpatched Vulnerability : CVE-2026-99128
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared...