Description

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference. A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(), so the association and its transports are freed. The endpoint loop has no counterpart to the asoc->base.dead check in sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed transport and is then passed to sctp_do_sm() with the freed association. The transport is freed through RCU, so this needs the packet to come off the socket backlog, where the loop runs in task context. The endpoint loop cannot do the same check: it holds no reference on the association, so reading asoc->base.dead would itself be a use-after-free. Mark the packet for discard in the command interpreter, just before it deletes the association. That is also before sctp_inq_free() releases the chunk on the association receive path. sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary association, while the one the packet belongs to stays alive. A restarting peer can bundle DATA behind its COOKIE ECHO, so compare against chunk->asoc and leave that case alone.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:29.337Z",
  "pubdate": "2026-09-11T20:19:29.337Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation during packet processing.\nThe vulnerability arises when an SCTP association is deleted during the processing of a multi-chunk packet, leading to subsequent chunks referencing freed memory (association/transport objects).\nThis flaw affects the SCTP state machine and endpoint handling logic.\nAn unauthenticated, remote attacker can trigger this condition by crafting a specific packet containing multiple chunks, such as a COOKIE ECHO followed by SHUTDOWN and SHUTDOWN ACK.\nThe successful exploitation of this vulnerability leads to kernel memory corruption, which can cause system instability, denial of service (DoS), or potentially arbitrary code execution depending on the state of the kernel memory allocator.\nThe issue persists because the endpoint loop lacks a mechanism to verify the liveness of the association after an operation potentially triggers its destruction.",
  "technicalDetails": "The root cause is a failure to synchronize association liveness checks within the sctp_endpoint_bh_rcv() processing loop. When the kernel processes an SCTP packet, it may perform an association lookup if chunk->asoc is NULL. The result of this lookup is cached in the chunk structure without establishing a formal reference count.\nThe attack flow leverages the ability of a peer to bundle multiple control chunks within a single SCTP packet. For instance, an attacker can bundle a COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK. The COOKIE ECHO chunk initializes a new association. Subsequently, the SHUTDOWN chunk causes the system to cache this association pointer. The SHUTDOWN ACK chunk is then passed to sctp_sf_do_9_2_final(), which invokes the termination sequence, resulting in the freeing of the association and its associated transport structures.\nBecause the sctp_endpoint_bh_rcv() loop does not check the 'dead' status of the association (asoc->base.dead) after a transition, the subsequent chunks in the same packet continue to use the pointer to the now-freed association and transport objects. Specifically, the kernel may attempt to update last_time_heard within the freed transport object or pass the freed association to sctp_do_sm().\nThis constitutes a use-after-free because the memory associated with the SCTP association and transport has been released, but the processing loop maintains stale references. Since the transport object is freed via RCU, this vulnerability is particularly exploitable when the packet is processed from the socket backlog in task context. The lack of reference counting during the endpoint loop prevents the kernel from detecting that the underlying object is no longer valid for further operations.\nWhile the patch introduces a command to mark the packet for discard in the command interpreter before association deletion occurs, the vulnerability highlights a fundamental design limitation in how the SCTP state machine handles multi-chunk packets that include terminal state transitions."
}