M3UAScan

M3UAScan A Scanner for M3UA protocol to detect Sigtran supporting nodes M3UA stands for MTP Level 3 MTP3 User Adaptation Layer as defined by the IETF SIGTRAN working group in RFC 4666 .M3UA enables the SS7 protocol's User Parts e.g. ISUP, SCCP and TUP to run over IP instead of telephony equipment...

CVE-2026-64564

Debian 13 6.12.95 SCTP ASCONF DEL-IP UAF proof of concept. gcc -O2 -static -o lpe lpedebian.6.12.95.c ./lpe...

sctphantom

SCTPhantom — Linux kernel SCTP ASCONF use-after-free tracking site Source for the SCTPhantom patch-status tracker: a single-page site recording which distributions have shipped a fix for the SCTP ASCONF transport use-after-free in the Linux kernel. Where the facts live Everything about the bug —...

SUSE-SU-2026:3602-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-46056: Bluetooth: hcievent: fix potential UAF in SSP passkey handlers bsc1267435. - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks...

tsh-sctp

Tiny SHell - オープンソースのUNIXバックドア Tiny SHell をコンパイルする前に 1. まず最初に、tsh.h 内にあるシークレットキーを設定してください。 キーは任意の長さにできます（安全性を高めるには、少なくとも12文字を使用してください）。 2. SERVERPORT（サーバーが着信接続を待ち受けるポート）を変更することを お勧めします。 3. ファイアウォールで保護されたマシン上で実行する場合は、tshd を "connect-back" モードで起動したいと思うかもしれません。その場合は、 tsh.h 内の CONNECTBACKHOST...

tsh-sctp

Tiny SHell - An open-source UNIX backdoor Before compiling Tiny SHell 1. First of all, you should setup your secret key, which is located in tsh.h; the key can be of any length use at least 12 characters for better security. 2. It is advised to change SERVERPORT, the port on which the server will...

CVE-2020-6514

CVE-2020-6514 The exploit When writing the exploit, I originally altered the SCTP packets sent to the target device by altering the source of WebRTC and recompiling it. This wasn’t practical for attacking closed source applications, so I eventually switched to using Frida to hook the binary of th...

SUSE SLES16 Security Update : kernel (Live Patch 4 for SUSE Linux Enterprise 16) (SUSE-SU-2026:23942-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23942-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues: The following security issues we...

SUSE SLES16 Security Update : kernel (Live Patch 9 for SUSE Linux Enterprise 16) (SUSE-SU-2026:23937-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23937-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues: The following security issues...

SUSE SLES16 Security Update : kernel (Live Patch 3 for SUSE Linux Enterprise 16) (SUSE-SU-2026:23941-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23941-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues: The following security issues we...

CVE-2019-8956

CVE-2019-8956 sctp-PoC sctp lib がインストールされている必要があります gcc sctp-2019-8956-poc.c -o sctp-2019-8956-poc -pthread -lsctp -static...

CVE-2026-74586

CVE-2026-74586 — SCTP ASCONF newtransport use-after-free trigger A self-contained, unprivileged PoC for CVE-2026-74586, a use-after-free in the Linux kernel's SCTP ASCONF dynamic address reconfiguration handling. Credit for the bug itself goes to Qing Ming, who reported it upstream; the fix is...

DiagSpill

DiagSpill CVE-2026-74469 分析文章 !WARNING 本 PoC 仅用于帮助防御者、维护者和经授权的安全团队验证其拥有或明确获授权测试的系统上的补丁、缓解措施、检测规则和暴露情况。 您需自行负责确保对本材料的使用是合法、经授权、受控的，并在隔离的测试环境中进行。 !WARNING 本 PoC 具有破坏性。 它会覆写约 8 MiB 的内核内存，并使 diagspillhold 牺牲内存持有者所持有的已损坏页表一直保留到重启。终止该进程可能导致内核不稳定。 无关内存可能被破坏，机器可能发生 panic。请仅在一次性虚拟机/一次性主机上运行。 该 PoC： 1. 编译内...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2026_59737)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202659737 advisory. kernel: sctp: purge outqueue on stale COOKIE-ECHO handling CVE-2026-52924 kernel: scsi: target: iscsi: Validate CHAPR length before base64 decode...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing CVE-2026-64564 In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdiscrtablist against concurrent get/put...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-131)

The version of kernel installed on the remote host is prior to 5.4.302-229.498. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2026-131 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own...

Ubuntu 20.04 LTS : Linux kernel (BlueField) vulnerabilities (USN-8850-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8850-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_59723)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202659723 advisory. kernel: ksm: use range-walk function to jump over holes in scangetnextrmapitem CVE-2025-68211 kernel: ip6tunnel: use skbvlaninetprepare in ip6tnlrcv...

Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_36956)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202636956 advisory. kernel: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange CVE-2025-71066 kernel: sctp: revalidate list cursor afte...