EUVD-2026-76384

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctprcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctpaddbacklog takes if the socket is owned by userspace, keeps it...

CVE-2026-89478

CVE-2026-89478 is a use-after-free in the Linux kernel's SCTP implementation. An authenticated attacker can send an ASCONF DEL-IP to remove a transport while a DATA chunk is still in flight (on the socket backlog or direct path). The chunk's lingering transport reference causes the transport to b...

CVE-2026-89478 sctp: drop a chunk if its transport was removed

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctprcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctpaddbacklog takes if the socket is owned by userspace, keeps it...

CVE-2026-89478 sctp: drop a chunk if its transport was removed

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctprcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctpaddbacklog takes if the socket is owned by userspace, keeps it...

CVE-2026-89476

CVE-2026-89476 affects the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. A cached RECONF chunk may contain multiple request parameters, so a duplicate response can re-process the same ADD_OUT request while another parameter is still outstanding, rolling back stream-&g...

CVE-2026-89476 sctp: fix stream->outcnt underflow on duplicate RECONF responses

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-89477

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctpprocessstrresetoutreq, sctpprocessstrresetaddstrmout and sctpprocessstrresetresp complete a pending stream reconfiguration request by stopping the reconf timer on the...

EUVD-2026-76382

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-89476 sctp: fix stream->outcnt underflow on duplicate RECONF responses

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-89477 sctp: fix NULL deref on untransmitted RECONF completion

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctpprocessstrresetoutreq, sctpprocessstrresetaddstrmout and sctpprocessstrresetresp complete a pending stream reconfiguration request by stopping the reconf timer on the...

CVE-2026-89476

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

EUVD-2026-76383

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctpprocessstrresetoutreq, sctpprocessstrresetaddstrmout and sctpprocessstrresetresp complete a pending stream reconfiguration request by stopping the reconf timer on the...

CVE-2026-89477

CVE-2026-89477 is a NULL pointer dereference in the Linux kernel's SCTP stream reconfiguration code. When a reconfiguration request is queued in asoc->strreset_chunk but not yet transmitted, chunk->transport remains NULL; three completion functions (sctp_process_strreset_outreq, sctp_proces...

CVE-2026-89477 sctp: fix NULL deref on untransmitted RECONF completion

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctpprocessstrresetoutreq, sctpprocessstrresetaddstrmout and sctpprocessstrresetresp complete a pending stream reconfiguration request by stopping the reconf timer on the...

sctphantom

SCTPhantom — 리눅스 커널 SCTP ASCONF use-after-free 추적 사이트 SCTPhantom 패치 상태 추적기의 소스: 리눅스 커널의 SCTP ASCONF transport use-after-free에 대한 수정을 출시한 배포판을 기록하는 단일 페이지 사이트입니다. 실제 정보가 있는 곳 버그에 관한 모든 것 — CVE ID, 영향받는 버전 및 수정된 버전, 업스트림 수정 커밋, 발견 및 공개 공로, 그리고 현재 배포판별 패치 상태 — 은 이 README가 아니라 추적기 페이지에 있습니다: 렌더링:...

kernel-rt security, bug fix, and enhancement update

An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

PT-2026-90194

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp rcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctp add backlog takes if the socket is owned by userspace, keeps ...

PT-2026-90193

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp process strreset outreq, sctp process strreset addstrm out and sctp process strreset resp complete a pending stream reconfiguration request by stopping the reconf timer...

Oracle Linux 8 : ELSA-2026-66325-0: / kernel (ELSA-2026-663250)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-663250 advisory. - tipc: fix slab-use-after-free Read in tipcaeaddecryptdone Xin Long RHEL-228877 CVE-2026-63801 - tipc: clear sock-sk on the failed-insert path in...