# CVE-2026-89478: sctp: drop a chunk if its transport was removed

> A use-after-free vulnerability in the Linux kernel SCTP implementation allows attackers to cause denial of service or potentially execute code via crafted packets.

- **Severity:** Critical 9.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 11 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-100127, BELL-CVE-2026-89478, DEBIAN-CVE-2026-89478, GHSA-47r2-m88p-rgjm, UBUNTU-CVE-2026-89478

## What is CVE-2026-89478?

CVE-2026-89478 is a critical use after free vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

sctp: drop a chunk if its transport was removed

sctp_rcv() resolves the transport once per packet and leaves it in
chunk->transport. The lookup reference, or the one sctp_add_backlog() takes
if the socket is owned by userspace, keeps it around until the chunk has
been processed.

An authenticated ASCONF DEL-IP can remove it in the meantime.
sctp_assoc_rm_peer() takes the transport out of the association and calls
sctp_transport_free(), which tags it dead and drops the reference the
association held. There is a window on both paths: the packet can sit on
the socket backlog, and on the direct path the lookup completes before
bh_lock_sock().

The DATA chunk in that packet puts the removed transport back into
asoc->peer.last_data_from. Once the packet is done that reference goes
away and the transport is freed by RCU, so the next delayed SACK carries
the pointer into the SACK chunk and sctp_outq_select_transport() reads the
freed transport's state.

Drop the chunk in sctp_inq_push(), next to the existing rcvr->dead check.
Both paths reach it with the association's socket lock held. The peer
retransmits it.

## Which versions are affected by CVE-2026-89478?


## How do I fix CVE-2026-89478?

Apply the vendor's patch.

## Is CVE-2026-89478 being exploited?

There is no known exploitation of CVE-2026-89478 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-89478 and fix it if it is affected.

What it is: CVE-2026-89478 is a critical use after free vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-89478 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-89478/ (Markdown: https://insights.sbomify.com/CVE-2026-89478/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-89478
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89478
- OSV: https://osv.dev/vulnerability/CVE-2026-89478

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-89478/
Summaries are generated and may contain mistakes; the official description above is the record.