CVE-2026-89478

CVE-2026-89478 is a use-after-free in the Linux kernel SCTP subsystem. The root cause is a race condition: an authenticated ASCONF DEL-IP can remove a transport while a received chunk still holds a reference to it. After the packet is processed, the reference count drops, the transport is freed v...

CVE-2026-89478 sctp: drop a chunk if its transport was removed

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctprcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctpaddbacklog takes if the socket is owned by userspace, keeps it...