Which versions of illumos are affected by CVE-2026-15422?

The illumos SCTP stack contains a critical kernel vulnerability (CVSS 9.1) enabling unauthenticated remote attackers to crash systems or potentially gain kernel-level access.. A patch is available.

How to fix or mitigate CVE-2026-15422?

Within 24 hours, identify all systems running illumos-gate, OmniOS, or SmartOS/Triton built before commit 53a3efde. Within 7 days, apply vendor patches or rebuilt images incorporating commit 53a3efde to all affected systems, prioritizing internet-facing and business-critical hosts. Within 30 days, complete infrastructure-wide patching, audit kernel versions to confirm remediation, and validate SCTP service functionality.

illumos CVE-2026-15422

Q: What is the CVSS score of CVE-2026-15422?

CVE-2026-15422 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:H/U:Red. EPSS exploitation probability: 0.5%.

EUVD-2026-45014 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-07-16 illumos

GHSA-7fj7-gprr-x7fm

RCE Heap Overflow Buffer Overflow Illumos Gate Omnios Smartos

9.1

CVSS 4.0 · Vendor: illumos

Severity by source

Vendor (illumos) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:H/U:Red

vuln.today AI

8.1 HIGH

Remote unauthenticated packet reaches the lookup before any auth (AV:N/PR:N/UI:N); reliable kernel-heap RCE needs grooming so AC:H, while kernel compromise yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (illumos).

CVSS VectorVendor: illumos

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 16, 2026 - 20:17 vuln.today

Analysis Generated

Jul 16, 2026 - 20:17 vuln.today

CVE Published

Jul 16, 2026 - 19:29 cve.org

CRITICAL 9.1

DescriptionCVE.org

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.

AnalysisAI

Remote kernel heap corruption in the illumos SCTP stack lets an unauthenticated attacker send a crafted INIT ACK packet with malformed address parameters to trigger an out-of-bounds access during packet classification, potentially leading to remote code execution or a kernel panic. The flaw affects illumos-gate and downstream distributions (OmniOS, SmartOS/Triton) built before commit 53a3efde, and has existed since 2010 (commit a5407c02). There is no public exploit identified at time of analysis and the CVSS 4.0 exploit-maturity metric is Unreported (E:U), but the attack requires no authentication or user interaction.

Technical ContextAI

The vulnerability lives in the illumos SCTP (Stream Control Transmission Protocol, RFC 9260/4960) inbound path, specifically the association-lookup logic that parses INIT ACK chunks (sctp_lookup_by_faddrs / sctp_addrlist2sctp in sctp_hash.c and sctp_cookie.c). Because a multi-homed peer may advertise additional addresses in an INIT ACK, the kernel walks the chunk's address parameters to find the matching association. The pre-patch code trusted that these parameters were validated, but sctp_check_input() only verified that parameter sizes fit within the chunk - not that individual IPv4 (8-byte) or IPv6 (20-byte) address parameters were well-formed. This is a classic CWE-122 heap-based buffer overflow: malformed sph_len values let parsing read/index past allocated heap bounds. The fix adds explicit length checks (rejecting IPv4 params whose length != 8 and IPv6 params whose length != 20), pre-allocates a correctly sized pointer/address array with kmem_zalloc bounded by the remaining bytes, and bounds the parse loop by pointer_count < most_v4.

RemediationAI

Upstream fix available (commit; released patched version not independently confirmed): apply illumos-gate commit 53a3efde (https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75) by upgrading to a distribution build that includes it - OmniOS and SmartOS/Triton users should pull the corresponding rebuilt platform image or kernel package from their vendor once it carries this commit. If an updated build cannot be deployed immediately, the most effective compensating control is to prevent unsolicited SCTP INIT ACK packets from reaching vulnerable hosts: block IP protocol 132 (SCTP) at the network perimeter or host firewall (ipf/pf) for any interface that does not legitimately terminate SCTP associations - the trade-off is that this breaks any real SCTP-based services (e.g. telecom/SIGTRAN or SCTP-enabled applications). Where SCTP is not needed at all, ensure the SCTP module is not in active use. Reference the tracking issue at https://illumos.org/issues/18117 for release status.