Use-after-free in Linux kernel - CVE-2026-89479

Vulnerability identifier: #VU149329

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-89479

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to access freed memory.

The vulnerability exists due to use-after-free in the SCTP endpoint receive loop when processing a specially crafted SCTP packet containing bundled chunks. A remote attacker can send an SCTP packet that deletes an association before subsequent chunks are processed to access freed memory.

Exploitation requires the packet to be processed from the socket backlog in task context.

Linux kernel
openEuler
kernel
bpftool
bpftool-debuginfo
kernel-debuginfo
kernel-debugsource
kernel-devel
kernel-headers
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python3-perf
python3-perf-debuginfo

Install security update from vendor's repository.

kernel - update to 5.10.0-335.0.0.236
bpftool - update to 5.10.0-335.0.0.236
bpftool-debuginfo - update to 5.10.0-335.0.0.236
kernel-debuginfo - update to 5.10.0-335.0.0.236
kernel-debugsource - update to 5.10.0-335.0.0.236
kernel-devel - update to 5.10.0-335.0.0.236
kernel-headers - update to 5.10.0-335.0.0.236
kernel-source - update to 5.10.0-335.0.0.236
kernel-tools - update to 5.10.0-335.0.0.236
kernel-tools-debuginfo - update to 5.10.0-335.0.0.236
kernel-tools-devel - update to 5.10.0-335.0.0.236
perf - update to 5.10.0-335.0.0.236
perf-debuginfo - update to 5.10.0-335.0.0.236
python3-perf - update to 5.10.0-335.0.0.236
python3-perf-debuginfo - update to 5.10.0-335.0.0.236

• https://git.kernel.org/stable/c/47e15a8d12e366d0d261bcbc394394f44418938d
• https://git.kernel.org/stable/c/a713e1b3a265f180ad25a08e17be15d67a2f7149
• https://git.kernel.org/stable/c/ee3f04cf566f6041aa9a0360494fd8db5ade383a
• https://git.kernel.org/stable/c/fa306a40e716c5abcd967475459ce1ebd56e5115

• Use-after-free in Linux kernel sctp
• openEuler 22.03 LTS SP4 update for kernel