SB20260912319 - Integer underflow in Linux kernel sctp

Description

This security bulletin contains information about 1 vulnerability.

1) Integer underflow (CVE-ID: CVE-2026-89476)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an integer underflow.

The vulnerability exists due to improper tracking of outstanding stream reconfiguration request parameters in SCTP stream reconfiguration response handling when processing duplicate RECONF responses. A remote attacker can send duplicate RECONF responses to cause an integer underflow.

A cached RECONF chunk containing multiple request parameters must have another parameter still outstanding.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2d867663c563e8009257b9edf9c8ec75d9bbf19a
• https://git.kernel.org/stable/c/3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e
• https://git.kernel.org/stable/c/8320cbd81bc21a1ca6ebdf70ad610ebc5ef1bd68
• https://git.kernel.org/stable/c/d02a5794c3deedcb8476d017fcee2b7aaedab2e1