In the Linux kernel, the following vulnerability has been resolved:
sctp: check send stream number after wait_for_sndbuf
This patch fixes a corner case where the asoc out stream count may change after wait_for_sndbuf.
When the main thread in the client starts a connection, if its out stream count is set to N while the in stream count in the server is set to N - 2, another thread in the client keeps sending the msgs with stream number N - 1, and waits for sndbuf before processing INIT_ACK.
However, after processing INIT_ACK, the out stream count in the client is shrunk to N - 2, the same to the in stream count in the server. The crash occurs when the thread waiting for sndbuf is awake and sends the msg in a non-existing stream(N - 1), the call trace is as below:
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] Call Trace: <TASK> sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170 sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163 sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868 sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825 sock_sendmsg_nosec net/socket.c:722 [inline] sock_sendmsg+0xde/0x190 net/socket.c:745
The fix is to add an unlikely check for the send stream number after the thread wakes up from the wait_for_sndbuf.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.178-162.673Upgrade kernel-tools-develUpgrade kernelUpgrade perfUpgrade bpftoolUpgrade kernel-develUpgrade python-perfUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.108-65.141Upgrade bpftool-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-libbpf-develUpgrade kernelUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-libbpfUpgrade python3-perfUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade perfUpgrade bpftoolUpgrade kernel-livepatch-6.1.25-37.47Upgrade python3-perf-debuginfo | Sep 30, 2025 | Sep 16, 2025 |
| Debian | — | Upgrade linux | Sep 18, 2025 | Sep 18, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelists | Feb 3, 2026 | Jan 30, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution exists | Nov 14, 2025 | Sep 16, 2025 |
| Ubuntu | — | Upgrade linux-azureUpgrade linux-bluefieldUpgrade linux-fipsUpgrade linux-intel-iotg-5.15Upgrade linux-oracle-5.15Upgrade linux-gkeopUpgrade linux-hwe-5.4Upgrade linux-lowlatencyUpgrade linux-intel-iotgUpgrade linux-gcp-fipsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-azure-5.4Upgrade linux-riscv-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-raspiUpgrade linux-ibmUpgrade linux-kvmUpgrade linux-hwe-5.15Upgrade linux-nvidiaUpgrade linux-iotUpgrade linux-gcp-5.15Upgrade linux-realtimeUpgrade linux-oracleUpgrade linux-aws-fipsUpgrade linux-azure-5.15Upgrade linux-raspi-5.4Upgrade linux-nvidia-tegra-igxUpgrade linux-ibm-5.4Upgrade linux-oracle-5.4Upgrade linux-aws-5.15Upgrade linux-ibm-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-nvidia-tegraUpgrade linux-gkeUpgrade linux-intel-iot-realtimeUpgrade linux-aws-5.4Upgrade linux-gcp-5.4Upgrade linux-awsUpgrade linuxUpgrade linux-gcpUpgrade linux-azure-fips | Sep 19, 2025 | Sep 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub