Loading story…
A critical vulnerability tracked as CVE-2026-15422 was disclosed in the illumos SCTP stack, where improper validation of INIT ACK chunk address parameters can let a remote, unauthenticated attacker trigger kernel heap corruption and potentially achieve remote code execution. The flaw affects the SCTP inbound path because association lookup for INIT ACK traffic occurs before SCTP integrity checks and before IPsec policy is applied, expanding exposure for systems that process crafted network packets. The issue has reportedly existed since a 2010 illumos-gate commit and impacts illumos-based platforms including downstream distributions such as SmartOS.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-15422 was publicly listed as a critical illumos SCTP vulnerability with CVSS 9.1, describing how remote unauthenticated attackers could trigger kernel heap corruption and potentially achieve remote code execution on affected illumos distributions.
The CVE record states the SCTP flaw has existed since 2010, when illumos-gate commit a5407c02 introduced the vulnerable INIT ACK association lookup behavior without sufficient address parameter validation.
A fix for bug #18117 was published in illumos-gate as commit 53a3efde, adding stricter validation for SCTP INIT ACK chunk and address parameter handling to prevent malformed traffic from triggering unsafe processing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceillumos.org
Open sourceillumos.topicbox.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple Linux kernel memory-corruption vulnerabilities affecting network-facing components, including a **remote heap overflow** in the Transparent Inter Process Communication (**TIPC**) module tracked as `CVE-2021-43267`, and a later packet-socket flaw, `CVE-2025-38617`, that was shown to be exploitable through a race condition. The TIPC issue exposed systems running the module to potential **arbitrary code execution in kernel context**, highlighting the risk posed by rarely used but reachable networking features in default or enterprise Linux deployments. Additional advisory coverage from the Zero Day Initiative underscored continued security concerns around Linux kernel bug classes such as heap overflows and race conditions, which can be leveraged for **privilege escalation** or full system compromise depending on exposure and configuration. Together, the reports show that flaws in low-level packet handling and inter-process communication paths remain a high-impact attack surface, especially where vulnerable kernel modules are enabled or accessible to untrusted users or networks.
Jun 29, 2026
Erlang/OTP disclosed **CVE-2026-49759**, a high-severity stack buffer overflow in the `inet_drv` SCTP error-cause parsing path that can let an unauthenticated remote attacker crash the BEAM VM. The flaw is in `sctp_parse_error_chunk` in `erts/emulator/drivers/common/inet_drv.c`, where crafted SCTP `ERROR` chunks can overflow a fixed-size stack buffer while cause codes are converted into `ErlDrvTermData` entries. Exploitation requires SCTP support to be enabled, a listening SCTP socket to be exposed through `gen_sctp` using the default `inet` backend, and network reachability to that port; Windows builds are not affected because SCTP is unsupported there. Advisories and the upstream patch indicate the issue is primarily **denial of service**, not expected remote code execution, because stack protections should terminate the process before meaningful control of execution is possible and the overwrite pattern is constrained. A crafted packet may also leak limited Erlang VM memory in an error response. The vulnerability affects OTP releases from **17.0** up to but excluding **27.3.4.13**, **28.5.0.2**, and **29.0.2**. The fix adds bounds checking and truncation safeguards in SCTP parsing and related async-event handling to prevent output term buffer overruns during malformed packet processing.
Jun 29, 2026
OpenBSD disclosed **CVE-2026-56099**, a medium-severity flaw in the MPLS subsystem that can expose kernel stack memory to a remote attacker when MPLS is enabled on an interface. The bug is in `mpls_do_error()` in `sys/netmpls/mpls_input.c`, where a crafted MPLS packet with **16 labels** and no **Bottom-of-Stack** bit causes the kernel to copy **17 shim headers** from a **16-entry** local stack array, leaking **4 bytes** of adjacent kernel stack data in an ICMP/MPLS error response. The issue affects OpenBSD `-current` before the fix and traces back to code introduced in 2010 in the ICMP/MPLS error-handling path. Exploitation requires an attacker to send an MPLS frame with EtherType `0x8847`, an outer label TTL of `1`, and an IPv4 inner payload; researchers at **Argus Systems** reported the vulnerability, and OpenBSD corrected it by rejecting label stacks that reach the maximum depth without a BoS bit.
Jun 29, 2026