EUVD-2026-76382
GHSA-p69r-6fx2-qv4w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SCTP is a network protocol; remote peers can send crafted RECONF responses without application-layer authentication, and impact is availability-only.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix stream->outcnt underflow on duplicate RECONF responses
A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADD_OUT request again while another parameter is still outstanding, rolling back outcnt twice and possibly underflowing it.
Track outstanding request types as bits and clear each bit after its first response. Later responses for the same request are then ignored.
AnalysisAI
Integer underflow in the Linux kernel's SCTP stream reconfiguration (RECONF) handler allows a remote SCTP peer to crash the kernel by sending duplicate RECONF response chunks. When a cached RECONF chunk contains an ADD_OUT request alongside other parameters, a duplicate response causes the kernel to roll back stream->outcnt twice - the second decrement underflows the unsigned counter and can trigger a kernel panic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active SCTP association between the attacker and the vulnerable host - a fully unauthenticated, arbitrary-internet-source attack is not possible without first completing or spoofing the SCTP four-way handshake (including verification tag exchange, which substantially complicates blind spoofing). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the network-reachable, unauthenticated nature of SCTP packet delivery, but overstates practical risk for most environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Linux kernel to a patched stable release: 6.12.109, 6.18.50, or 7.2.4 depending on the deployed stable branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems with SCTP protocol support in your infrastructure (servers, containers, network appliances) and prioritize production-critical systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today