CVE-2020-6514

CVE-2020-6514 The exploit When writing the exploit, I originally altered the SCTP packets sent to the target device by altering the source of WebRTC and recompiling it. This wasn’t practical for attacking closed source applications, so I eventually switched to using Frida to hook the binary of th...

CVE-2026-64564

Debian 13 6.12.95 SCTP ASCONF DEL-IP UAF proof of concept. root@kitploit: gcc -O2 -static -o lpe lpedebian.6.12.95.c ./lpe...

CVE-2026-89478

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An authenticated attacker could exploit a timing window during the removal of an SCTP transport. This could lead to the system attempting to read from freed memory, potentially causing a denial of...

CVE-2026-89479

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could send a specially crafted series of SCTP packets, leading to a use-after-free vulnerability. This occurs when the kernel attempts to access memory that has already been...

CVE-2026-89477

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. This vulnerability occurs when the kernel attempts to complete a stream reconfiguration request that has not been fully transmitted, leading to a null pointer dereference. An unprivileged loc...

CVE-2026-89476

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending specially crafted duplicate RECONF responses. This action can cause an underflow in the stream-outcnt counter, potentially leading to unexpected system...

M3UAScan

M3UAScan Un escáner para el protocolo M3UA para detectar nodos que soportan Sigtran M3UA significa Capa de Adaptación de Usuario de Nivel MTP 3 MTP3 según lo definido por el grupo de trabajo IETF SIGTRAN en RFC 4666. M3UA permite que las Partes de Usuario del protocolo SS7 por ejemplo, ISUP, SCCP...

CVE-2026-89478

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctprcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctpaddbacklog takes if the socket is owned by userspace, keeps it...

CVE-2026-89477

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctpprocessstrresetoutreq, sctpprocessstrresetaddstrmout and sctpprocessstrresetresp complete a pending stream reconfiguration request by stopping the reconf timer on the...

CVE-2026-89479

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A packet...

CVE-2026-89476

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-89479

CVE-2026-89479 is a use-after-free in the Linux kernel's SCTP subsystem. In sctp_endpoint_bh_rcv(), a packet's association and transport are cached without holding a reference. A peer can bundle COOKIE ECHO , SHUTDOWN , and SHUTDOWN ACK in a single packet, causing the association to be freed mid-...

CVE-2026-89479 sctp: stop processing a packet once its association is deleted

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A packet...

EUVD-2026-76385

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A packet...

CVE-2026-89478

CVE-2026-89478 is a use-after-free in the Linux kernel SCTP subsystem. The root cause is a race condition: an authenticated ASCONF DEL-IP can remove a transport while a received chunk still holds a reference to it. After the packet is processed, the reference count drops, the transport is freed v...

CVE-2026-89478 sctp: drop a chunk if its transport was removed

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctprcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctpaddbacklog takes if the socket is owned by userspace, keeps it...

EUVD-2026-76384

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctprcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctpaddbacklog takes if the socket is owned by userspace, keeps it...

CVE-2026-89476

CVE-2026-89476 is a Linux kernel vulnerability in the SCTP subsystem. A cached RECONF chunk may contain more than one request parameter, so a duplicate response can find and process the same ADD_OUT request again while another parameter is still outstanding, rolling back stream->outcnt twice a...

CVE-2026-89476 sctp: fix stream->outcnt underflow on duplicate RECONF responses

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

EUVD-2026-76382

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...