CVE-2026-23125

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT

A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key

initialization fails:

==================================================================

KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]

CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2

RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline]

RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401

Call Trace:

sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189

sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111

sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217

sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787

sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]

sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169

sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associol

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References