CVE-2026-89476sctp: fix stream->outcnt underflow on duplicate RECONF responses
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream->outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADD_OUT request again while another parameter is still outstanding, rolling back outcnt twice and possibly underflowing it. Track outstanding request types as bits and clear each bit after its first response. Later responses for the same request are then ignored.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 before 041f7df5a929d3e7435dd8387e8ea17f2d412b7d; from 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 before 59f61c39cb99ee1737bd742a20094fe5653389bb; from 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 before 793519e343867ee9a3e84f6cac07f81f2aec7b5d; from 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 before 092acd3c55a4077b00489064615d8d2d898daf91; 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 builds before 2d867663c563e8009257b9edf9c8ec75d9bbf19a; from 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 before d02a5794c3deedcb8476d017fcee2b7aaedab2e1; from 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 before 8320cbd81bc21a1ca6ebdf70ad610ebc5ef1bd68; 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 builds before 3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e | CNA record |
References
- https://git.kernel.org/stable/c/041f7df5a929d3e7435dd8387e8ea17f2d412b7d
- https://git.kernel.org/stable/c/59f61c39cb99ee1737bd742a20094fe5653389bb
- https://git.kernel.org/stable/c/793519e343867ee9a3e84f6cac07f81f2aec7b5d
- https://git.kernel.org/stable/c/092acd3c55a4077b00489064615d8d2d898daf91
- https://git.kernel.org/stable/c/2d867663c563e8009257b9edf9c8ec75d9bbf19a
- https://git.kernel.org/stable/c/d02a5794c3deedcb8476d017fcee2b7aaedab2e1
- https://git.kernel.org/stable/c/8320cbd81bc21a1ca6ebdf70ad610ebc5ef1bd68
- https://git.kernel.org/stable/c/3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.