Loading vulnerability…
Remote kernel heap corruption in illumos SCTP INIT ACK association lookup
CVE-2026-15422 is a critical vulnerability in the illumos SCTP inbound processing path. During association lookup for SCTP INIT ACK chunks, the kernel does not adequately validate address parameters carried in the chunk before using them. This lookup occurs during packet classification, before SCTP integrity checks and before IPsec policy is applied. A remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet containing malformed address parameters to trigger an out-of-bounds access in kernel memory, resulting in heap corruption. The flaw has existed since 2010 and affects illumos-based systems prior to illumos-gate commit 53a3efde.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt kernel heap memory through an out-of-bounds access in the SCTP processing path. This can cause kernel instability or crashes and may permit remote code execution in kernel context. Because the vulnerable processing occurs before SCTP integrity validation and before IPsec policy enforcement, the attack surface includes unauthenticated network traffic reaching the SCTP stack.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling SCTP where it is not required, filtering SCTP traffic at network boundaries and host firewalls, and restricting untrusted network access to systems running the illumos SCTP stack. Because the vulnerable path is reached before SCTP integrity checks and IPsec policy are applied, relying on those controls alone is insufficient.
Patch, then assume compromise.
Update illumos or the downstream distribution to a version that includes illumos-gate commit 53a3efde or later. For downstream platforms, install the vendor release containing the SCTP INIT ACK address-parameter validation fix. Reported fixed versions include SmartOS builds from 20260709 onward and OmniOS releases r151058j, r151056aj, and r151054bj or later in their respective branches.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.