{"api_version":"1","generated_at":"2026-09-12T03:40:08+00:00","cve":"CVE-2026-89477","urls":{"html":"https://cve.report/CVE-2026-89477","api":"https://cve.report/api/cve/CVE-2026-89477.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89477","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89477"},"summary":{"title":"sctp: fix NULL deref on untransmitted RECONF completion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix NULL deref on untransmitted RECONF completion\n\nsctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and\nsctp_process_strreset_resp() complete a pending stream reconfiguration\nrequest by stopping the reconf timer on the transport it was sent on:\n\n\tt = asoc->strreset_chunk->transport;\n\tif (timer_delete(&t->reconf_timer))\n\t\tsctp_transport_put(t);\n\nchunk->transport is assigned by __sctp_packet_append_chunk() when the\nchunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms\nthe reconf timer at that same point. A request already published in\nasoc->strreset_chunk but not yet transmitted has neither, so completing\nit dereferences NULL.\n\nTwo ways to get there. sctp_send_asconf_del_ip() sets\nasoc->src_out_of_asoc_ok without sending anything when the address being\nremoved is the association's last one, and sctp_outq_flush_ctrl() then\nleaves every non-ASCONF control chunk queued; as only\nsctp_process_asconf_ack() clears that flag, it persists. An unprivileged\nprocess that removes such an address and then asks for a stream reset\npanics the kernel from softirq. A peer needs neither ASCONF nor local\nhelp: sctp_cmd_interpreter() uncorks the outqueue only once the whole\npacket has been processed, so a reply built while walking a RECONF chunk\nstays untransmitted for the rest of that walk, and one RECONF chunk\ncarrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,\nResponse] -- or two RECONF chunks in one packet -- reaches the same\ndereference.\n\n  KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]\n  RIP: 0010:timer_delete+0x67/0x110\n  Call Trace:\n   <IRQ>\n   sctp_process_strreset_addstrm_out (net/sctp/stream.c:832)\n   sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212)\n   sctp_do_sm (net/sctp/sm_sideeffect.c:1172)\n   sctp_assoc_bh_rcv (net/sctp/associola.c:1044)\n   sctp_rcv (net/sctp/input.c:243)\n   ip_local_deliver (net/ipv4/ip_input.c:262)\n   process_backlog (net/core/dev.c:6680)\n   </IRQ>\n\nA response can only acknowledge a request that was actually sent, so do\nnot match asoc->strreset_chunk while chunk->transport is NULL. Guarding\nthe lookup covers all three completion sites.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:19:29","updated_at":"2026-09-11 20:19:29"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/25419f516ea84b1e7d3d55aae5215ac86ece0c66","name":"https://git.kernel.org/stable/c/25419f516ea84b1e7d3d55aae5215ac86ece0c66","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0ee697defc0594f1da810ed75d9d643fb46f5318","name":"https://git.kernel.org/stable/c/0ee697defc0594f1da810ed75d9d643fb46f5318","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2db9bfa3e27bdea15e05ea70b56bad3d21e570ec","name":"https://git.kernel.org/stable/c/2db9bfa3e27bdea15e05ea70b56bad3d21e570ec","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/77ea60f2d24002c308f224db44a4542c466489af","name":"https://git.kernel.org/stable/c/77ea60f2d24002c308f224db44a4542c466489af","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89477","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89477","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81054476453640159149cb6704e834893e16736b 77ea60f2d24002c308f224db44a4542c466489af git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81054476453640159149cb6704e834893e16736b 25419f516ea84b1e7d3d55aae5215ac86ece0c66 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81054476453640159149cb6704e834893e16736b 0ee697defc0594f1da810ed75d9d643fb46f5318 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81054476453640159149cb6704e834893e16736b 2db9bfa3e27bdea15e05ea70b56bad3d21e570ec git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.11","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.109 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sctp/stream.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"77ea60f2d24002c308f224db44a4542c466489af","status":"affected","version":"81054476453640159149cb6704e834893e16736b","versionType":"git"},{"lessThan":"25419f516ea84b1e7d3d55aae5215ac86ece0c66","status":"affected","version":"81054476453640159149cb6704e834893e16736b","versionType":"git"},{"lessThan":"0ee697defc0594f1da810ed75d9d643fb46f5318","status":"affected","version":"81054476453640159149cb6704e834893e16736b","versionType":"git"},{"lessThan":"2db9bfa3e27bdea15e05ea70b56bad3d21e570ec","status":"affected","version":"81054476453640159149cb6704e834893e16736b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sctp/stream.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.11"},{"lessThan":"4.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.109","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.109","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"4.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix NULL deref on untransmitted RECONF completion\n\nsctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and\nsctp_process_strreset_resp() complete a pending stream reconfiguration\nrequest by stopping the reconf timer on the transport it was sent on:\n\n\tt = asoc->strreset_chunk->transport;\n\tif (timer_delete(&t->reconf_timer))\n\t\tsctp_transport_put(t);\n\nchunk->transport is assigned by __sctp_packet_append_chunk() when the\nchunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms\nthe reconf timer at that same point. A request already published in\nasoc->strreset_chunk but not yet transmitted has neither, so completing\nit dereferences NULL.\n\nTwo ways to get there. sctp_send_asconf_del_ip() sets\nasoc->src_out_of_asoc_ok without sending anything when the address being\nremoved is the association's last one, and sctp_outq_flush_ctrl() then\nleaves every non-ASCONF control chunk queued; as only\nsctp_process_asconf_ack() clears that flag, it persists. An unprivileged\nprocess that removes such an address and then asks for a stream reset\npanics the kernel from softirq. A peer needs neither ASCONF nor local\nhelp: sctp_cmd_interpreter() uncorks the outqueue only once the whole\npacket has been processed, so a reply built while walking a RECONF chunk\nstays untransmitted for the rest of that walk, and one RECONF chunk\ncarrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,\nResponse] -- or two RECONF chunks in one packet -- reaches the same\ndereference.\n\n  KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]\n  RIP: 0010:timer_delete+0x67/0x110\n  Call Trace:\n   <IRQ>\n   sctp_process_strreset_addstrm_out (net/sctp/stream.c:832)\n   sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212)\n   sctp_do_sm (net/sctp/sm_sideeffect.c:1172)\n   sctp_assoc_bh_rcv (net/sctp/associola.c:1044)\n   sctp_rcv (net/sctp/input.c:243)\n   ip_local_deliver (net/ipv4/ip_input.c:262)\n   process_backlog (net/core/dev.c:6680)\n   </IRQ>\n\nA response can only acknowledge a request that was actually sent, so do\nnot match asoc->strreset_chunk while chunk->transport is NULL. Guarding\nthe lookup covers all three completion sites."}],"providerMetadata":{"dateUpdated":"2026-09-11T19:43:33.851Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/77ea60f2d24002c308f224db44a4542c466489af"},{"url":"https://git.kernel.org/stable/c/25419f516ea84b1e7d3d55aae5215ac86ece0c66"},{"url":"https://git.kernel.org/stable/c/0ee697defc0594f1da810ed75d9d643fb46f5318"},{"url":"https://git.kernel.org/stable/c/2db9bfa3e27bdea15e05ea70b56bad3d21e570ec"}],"title":"sctp: fix NULL deref on untransmitted RECONF completion","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89477","datePublished":"2026-09-11T19:43:33.851Z","dateReserved":"2026-09-11T19:38:34.711Z","dateUpdated":"2026-09-11T19:43:33.851Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:19:29","lastModifiedDate":"2026-09-11 20:19:29","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89477","Ordinal":"1","Title":"sctp: fix NULL deref on untransmitted RECONF completion","CVE":"CVE-2026-89477","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89477","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix NULL deref on untransmitted RECONF completion\n\nsctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and\nsctp_process_strreset_resp() complete a pending stream reconfiguration\nrequest by stopping the reconf timer on the transport it was sent on:\n\n\tt = asoc->strreset_chunk->transport;\n\tif (timer_delete(&t->reconf_timer))\n\t\tsctp_transport_put(t);\n\nchunk->transport is assigned by __sctp_packet_append_chunk() when the\nchunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms\nthe reconf timer at that same point. A request already published in\nasoc->strreset_chunk but not yet transmitted has neither, so completing\nit dereferences NULL.\n\nTwo ways to get there. sctp_send_asconf_del_ip() sets\nasoc->src_out_of_asoc_ok without sending anything when the address being\nremoved is the association's last one, and sctp_outq_flush_ctrl() then\nleaves every non-ASCONF control chunk queued; as only\nsctp_process_asconf_ack() clears that flag, it persists. An unprivileged\nprocess that removes such an address and then asks for a stream reset\npanics the kernel from softirq. A peer needs neither ASCONF nor local\nhelp: sctp_cmd_interpreter() uncorks the outqueue only once the whole\npacket has been processed, so a reply built while walking a RECONF chunk\nstays untransmitted for the rest of that walk, and one RECONF chunk\ncarrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,\nResponse] -- or two RECONF chunks in one packet -- reaches the same\ndereference.\n\n  KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]\n  RIP: 0010:timer_delete+0x67/0x110\n  Call Trace:\n   <IRQ>\n   sctp_process_strreset_addstrm_out (net/sctp/stream.c:832)\n   sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212)\n   sctp_do_sm (net/sctp/sm_sideeffect.c:1172)\n   sctp_assoc_bh_rcv (net/sctp/associola.c:1044)\n   sctp_rcv (net/sctp/input.c:243)\n   ip_local_deliver (net/ipv4/ip_input.c:262)\n   process_backlog (net/core/dev.c:6680)\n   </IRQ>\n\nA response can only acknowledge a request that was actually sent, so do\nnot match asoc->strreset_chunk while chunk->transport is NULL. Guarding\nthe lookup covers all three completion sites.","Type":"Description","Title":"sctp: fix NULL deref on untransmitted RECONF completion"}]}}}