CVE-2026-89476

HighCVSS 7.5/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix stream->outcnt underflow on duplicate RECONF responses

A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADD_OUT request again while another parameter is still outstanding, rolling back outcnt twice and possibly underflowing it.

Track outstanding request types as bits and clear each bit after its first response. Later responses for the same request are then ignored.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3, < 041f7df5a929d3e7435dd8387e8ea17f2d412b7d; >= 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3, < 59f61c39cb99ee1737bd742a20094fe5653389bb; >= 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3, < 793519e343867ee9a3e84f6cac07f81f2aec7b5d; >= 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3, < 092acd3c55a4077b00489064615d8d2d898daf91; >= 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3, < 2d867663c563e8009257b9edf9c8ec75d9bbf19a; >= 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3, < d02a5794c3deedcb8476d017fcee2b7aaedab2e1; >= 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3, < 8320cbd81bc21a1ca6ebdf70ad610ebc5ef1bd68; >= 11ae76e67a179f25ae8f772d62a7ddf717b1cdf3, < 3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e
LinuxLinux4.12

References

Timeline

Published
Sep 11, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-894777.5In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_sCVE-2026-894789.8In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves thCVE-2026-894799.8In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_enCVE-2026-89489.1Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.CVE-2026-894807.5In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_dCVE-2026-894817.5In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcCVE-2026-894829.8In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone CVE-2026-894837.5In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme_setup_discard() always maps CVE-2026-89484In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt_loCVE-2026-894859.8In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_fiCVE-2026-894867.8In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Commit 9eCVE-2026-894877.8In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb_tx_error() a packet we are about to drop queue_u
CVE-2026-89476: High severity, CVSS 7.5 | Vulnix