In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted… (CVE-2026-89479)
A use-after-free vulnerability in the Linux kernel SCTP implementation was resolved. The issue occurs because packet processing continues after an SCTP association is deleted, leading to access of freed memory. This happens when multiple SCTP chunks are bundled in a single packet, causing the association and its transports to be freed prematurely while subsequent processing still references them. The fix marks packets for discard before deleting the association to prevent use-after-free conditions.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel SCTP subsystem arises from sctp_endpoint_bh_rcv() caching association pointers without taking references, allowing a packet with bundled COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK chunks to cause the association and its transports to be freed during processing. Subsequent chunks in the same packet then access freed memory, leading to a use-after-free. The endpoint loop lacks checks for association deletion due to no reference holding, causing unsafe memory access. The patch introduces marking the packet for discard before association deletion to avoid use-after-free errors.
Potential Impact
This vulnerability can lead to use-after-free conditions in the kernel SCTP code, potentially causing kernel crashes or memory corruption. There is no indication of known exploits in the wild. The impact is limited to SCTP packet processing in the Linux kernel and could affect system stability or security if exploited.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to mark packets for discard before deleting the SCTP association, preventing use-after-free. Users should apply the official kernel updates that include this patch. No additional mitigations are indicated by the vendor advisory.
In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted… (CVE-2026-89479)
Description
A use-after-free vulnerability in the Linux kernel SCTP implementation was resolved. The issue occurs because packet processing continues after an SCTP association is deleted, leading to access of freed memory. This happens when multiple SCTP chunks are bundled in a single packet, causing the association and its transports to be freed prematurely while subsequent processing still references them. The fix marks packets for discard before deleting the association to prevent use-after-free conditions.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel SCTP subsystem arises from sctp_endpoint_bh_rcv() caching association pointers without taking references, allowing a packet with bundled COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK chunks to cause the association and its transports to be freed during processing. Subsequent chunks in the same packet then access freed memory, leading to a use-after-free. The endpoint loop lacks checks for association deletion due to no reference holding, causing unsafe memory access. The patch introduces marking the packet for discard before association deletion to avoid use-after-free errors.
Potential Impact
This vulnerability can lead to use-after-free conditions in the kernel SCTP code, potentially causing kernel crashes or memory corruption. There is no indication of known exploits in the wild. The impact is limited to SCTP packet processing in the Linux kernel and could affect system stability or security if exploited.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to mark packets for discard before deleting the SCTP association, preventing use-after-free. Users should apply the official kernel updates that include this patch. No additional mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2f22-4vgf-p33p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89479"]
Threat ID: 6aa4a01c55bf5e2cf5a86725
Added to database: 09/12/2026, 00:43:08 UTC
Last enriched: 09/12/2026, 01:14:56 UTC
Last updated: 09/12/2026, 01:14:56 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.