Critical illumos SCTP INIT ACK flaw exposed kernel heap corruption risk

A critical vulnerability tracked as CVE-2026-15422 was disclosed in the illumos SCTP stack, where improper validation of INIT ACK chunk address parameters can let a remote, unauthenticated attacker trigger kernel heap corruption and potentially achieve remote code execution. The flaw affects the SCTP inbound path because association lookup for INIT ACK traffic occurs before SCTP integrity checks and before IPsec policy is applied, expanding exposure for systems that process crafted network packets. The issue has reportedly existed since a 2010 illumos-gate commit and impacts illumos-based platforms including downstream distributions such as SmartOS.