LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT

In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ================================================================== KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2 RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline] RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401 Call Trace: sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189 sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111 sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217 sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787 sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline] sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169 sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052 sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88 sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243 sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127 The issue is triggered when sctp_auth_asoc_init_active_key() fails in sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the command sequence is currently: - SCTP_CMD_PEER_INIT - SCTP_CMD_TIMER_STOP (T1_INIT) - SCTP_CMD_TIMER_START (T1_COOKIE) - SCTP_CMD_NEW_STATE (COOKIE_ECHOED) - SCTP_CMD_ASSOC_SHKEY - SCTP_CMD_GEN_COOKIE_ECHO If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while asoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by SCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL to be queued by sctp_datamsg_from_user(). Since command interpretation stops on failure, no COOKIE_ECHO should been sent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already been started, and it may enqueue a COOKIE_ECHO into the outqueue later. As a result, the DATA chunk can be transmitted together with the COOKIE_ECHO in sctp_outq_flush_data(), leading to the observed issue. Similar to the other places where it calls sctp_auth_asoc_init_active_key() right after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting T1_COOKIE. This ensures that if shared key generation fails, authenticated DATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT, giving the client another chance to process INIT_ACK and retry key setup.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-23125 is a Linux kernel SCTP flaw that can leave an authentication shared key unset after an initialization failure. Later SCTP transmission may dereference that missing key, causing a kernel null pointer dereference. The most likely business impact is service disruption on affected Linux systems that use SCTP.

Executive priority

Treat as a focused kernel reliability risk, not a confirmed mass-exploitation emergency. Patch affected SCTP-using Linux systems promptly through normal kernel update channels, with higher priority for telecom, signaling, or specialized infrastructure where SCTP is business-critical.

Technical view

The bug occurs in the SCTP INIT_ACK path when sctp_auth_asoc_init_active_key() fails after SCTP_CMD_PEER_INIT. peer auth state is set while asoc->shkey remains NULL, allowing authenticated DATA to be queued and later flushed with COOKIE_ECHO. The fix moves SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT.

Likely exposure

Exposure appears limited to affected Linux kernel versions with SCTP enabled and applications or services using SCTP, especially SCTP-AUTH. The source lists Linux as affected across multiple stable branches, but does not identify specific distributions or default configurations.

Exploitation context

The bundle does not report active exploitation, and KEV is false. The source describes a failure-triggered kernel null pointer dereference in SCTP transmit handling, but does not provide evidence of public exploitation, weaponization, or a confirmed attacker-controlled path.

Researcher notes

The key condition is command ordering after SCTP_CMD_PEER_INIT in sctp_sf_do_5_1C_ack(). Failure of shared-key setup leaves auth state inconsistent until queued DATA and COOKIE_ECHO reach output handling. The source does not include CVSS, CWE, exploitability assessment, or distribution mapping.

Mitigation direction

  • Apply Linux stable or distribution kernel updates containing the referenced SCTP fix.
  • Prioritize systems that run SCTP-dependent services or expose SCTP traffic.
  • Check vendor advisories for backported fixes and exact package versions.
  • If SCTP is unused, review vendor guidance for safely disabling or restricting it.

Validation and detection

  • Inventory Linux hosts and record kernel versions against vendor fixed releases.
  • Identify systems with SCTP modules enabled or SCTP sockets in operational use.
  • Confirm whether SCTP-AUTH dependent applications are present on exposed systems.
  • Verify patched kernels include the referenced stable SCTP command-ordering fix.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23125 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5, 730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5, 730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5, 730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5, 730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5, 730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5, 730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5unaffected
LinuxLinux2.6.24, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.