CVE-2026-15422

SCTP needs to better-check INIT ACK chunk parameters

State: Published
Severity: 9.1 Critical
Published: Jul 16, 2026
Updated: Jul 17, 2026
Reserved: Jul 10, 2026

Description

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.

Scores

CVSS	Score	Vector	Source
4.0	9.1 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/S:P/AU:Y/R:U/V:C/RE:H/U:Red	illumos

Weaknesses

CWE-122 Heap-based buffer overflow
CWE-787 Out-of-bounds write

Affected Products

Product	Versions
illumos-gateillumos	a5407c02d5ed61b29481b9b71f1307d7ebec9e5c to before 53a3efdeff8e6745bbfb69c5360f94962fb79e75Affectedfrom 53a3efdeff8e6745bbfb69c5360f94962fb79e75Not affected
OmniOSOmniOS	r151058 to before r151058jAffectedfrom r151058jNot affected r151056 to before r151056ajAffectedfrom r151056ajNot affected r151054 to before r151054bjAffectedfrom r151054bjNot affected any to before r151054Affected
SmartOSTriton Data Center	any to before 202060709Affectedfrom 20260709Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.