illumos CVE-2026-15422

Exploitation requires that the target illumos host has the SCTP stack active and reachable such that inbound SCTP packets are processed; the attacker sends an INIT ACK chunk containing address parameters with malformed sph_len values (IPv4 parameter length not equal to 8 bytes, or IPv6 not equal to 20 bytes). No authentication, no existing SCTP association, and no user interaction are needed (PR:N/UI:N) because the vulnerable lookup runs during packet classification BEFORE SCTP integrity checks or IPsec policy are applied - the packet does not need to belong to a valid handshake. Limiting factors: the host must actually process SCTP (protocol 132) traffic, so hosts that firewall or do not use SCTP are not exposed; the guaranteed outcome is kernel heap corruption/panic while full remote code execution is uncertain and would require reliable kernel heap manipulation; and the platform (illumos and derivatives) is niche.

This is a genuine high-priority issue but with important caveats. The CVSS 4.0 base signals (AV:N, AC:L, AT:N, PR:N, UI:N, all VC/VI/VA High) describe a remote, unauthenticated, no-interaction attack against the kernel, and the Automatable metric is Yes (AU:Y) - meaning the trigger can be scripted. However, the exploit-maturity metric is Unreported (E:U): there is no public exploit or KEV listing, so active exploitation is NOT confirmed. The description hedges the top-end impact ('may lead to remote code execution'), so the CERTAIN outcome is kernel heap corruption / panic (denial of service), while reliable RCE would require kernel heap grooming that is not demonstrated. Mitigating real-world exposure: SCTP must be reachable and in use, and illumos is a niche platform, so the practical attack surface is far smaller than the 9.1 score implies in isolation. Net: patch promptly on any SCTP-exposed illumos host, but this is not a widespread commodity-exploited threat today.

An attacker on the network sends a single crafted SCTP INIT ACK packet whose embedded IPv4 or IPv6 address parameters carry malformed length fields to a target illumos host. Because the association lookup parses these parameters during packet classification - before SCTP integrity checks or IPsec policy are applied - the malformed data drives an out-of-bounds heap access, corrupting kernel memory to cause a panic or, with careful heap grooming, arbitrary code execution. No public proof-of-concept exists at time of analysis, and no prior association or authentication is required.