{"id":"CVE-2026-15422","summary":"SCTP needs to better-check INIT ACK chunk parameters","details":"The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.","modified":"2026-09-04T08:05:21.533222Z","published":"2026-07-16T19:29:13.931Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15422.json","unresolved_ranges":[{"extracted_events":[{"introduced":"a5407c02d5ed61b29481b9b71f1307d7ebec9e5c"},{"fixed":"53a3efdeff8e6745bbfb69c5360f94962fb79e75"},{"introduced":"r151058"},{"fixed":"r151058j"},{"introduced":"r151056"},{"fixed":"r151056aj"},{"introduced":"r151054"},{"fixed":"r151054bj"},{"introduced":"any"},{"fixed":"r151054"},{"introduced":"any"},{"fixed":"202060709"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"introduced":"i.e"}],"source":"DESCRIPTION"}],"cna_assigner":"illumos","cwe_ids":["CWE-122","CWE-787"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15422.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15422"},{"type":"REPORT","url":"https://illumos.org/issues/18117"},{"type":"FIX","url":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75"},{"type":"PACKAGE","url":"https://github.com/illumos/illumos-gate"},{"type":"ARTICLE","url":"https://illumos.topicbox.com/groups/developer/Ta1a8e2e1f7f928df/18117-sctp-needs-to-better-check-init-ack-chunk-parameters"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/illumos/illumos-gate","events":[{"introduced":"0"},{"fixed":"53a3efdeff8e6745bbfb69c5360f94962fb79e75"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15422.json","vanir_signatures_modified":"2026-09-04T08:05:21Z","vanir_signatures":[{"id":"CVE-2026-15422-2c1c8989","signature_type":"Function","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75","target":{"file":"usr/src/uts/common/inet/sctp/sctp_cookie.c","function":"sctp_addrlist2sctp"},"deprecated":false,"digest":{"length":1536,"function_hash":"30902740663041772675893224636674900715"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75","target":{"file":"usr/src/uts/common/inet/sctp/sctp_input.c","function":"sctp_input_data"},"deprecated":false,"digest":{"function_hash":"324183870454557879017208925348142661426","length":14063},"id":"CVE-2026-15422-2f695e47"},{"target":{"file":"usr/src/uts/common/inet/sctp/sctp_impl.h"},"deprecated":false,"digest":{"line_hashes":["31250796518563773150558368498007695814","326793976049523642264567736353462661967","241255432121403975036081614120009011360","15391210411914908648776739741145100879","32386853272965417843634239669040629477","28115316761538356278935314249841268216","165123251668551396677332437080823512889","12127090190239809391843306958718451860","199163544633566990460348635504921068522","88181191378388852376755923320437460043","120315210042048090646101245353185751079","159918955648261573879202742156449803142","200638116558420236765880029619873126990","320513705672239885837281653236548173253","55865678848412173784235435085396038599","239116539363378177302762392226693016441","266403843622659414371935227268610223276","66686073836534716317204559567640873735","244233182505513738017198078588534243592","11765248141063405749077717721339480301","276508587060158572827087662095917481819","84324256971808284376125764891263110939","163747286605233073109437461595745337287","234703681428180026724910240627704939098","87168392264891166737409386777745377384","7133466869396674114394073474046654988","209184881076845525022944384523651372403","74040463965236250874622052807073489065","3261714018886918249076388110314439379","97836451141507901406762710042105795095","119721574017292207149380623117283826303","336190601633813952230927457718946110181","61011245061122057961065087562457112220","217988674884642187749054764602109527610","89398614758121888080644472969660556958","271679738764421003854360707503382290219"],"threshold":0.9},"id":"CVE-2026-15422-319eb8a2","signature_type":"Line","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75","target":{"file":"usr/src/uts/common/inet/sctp/sctp_input.c","function":"sctp_check_input"},"deprecated":false,"digest":{"length":1979,"function_hash":"318166070427195765407328075032979170612"},"id":"CVE-2026-15422-513bb683"},{"id":"CVE-2026-15422-607ed5ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75","target":{"file":"usr/src/uts/common/inet/sctp/sctp_hash.c","function":"sctp_fanout"},"deprecated":false,"digest":{"function_hash":"286673733422841101854067237543898662460","length":739}},{"source":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75","target":{"file":"usr/src/uts/common/inet/sctp/sctp_input.c"},"deprecated":false,"digest":{"line_hashes":["251910662685572429178377142683056572836","177255137536229051349162066813837843506","11776340839431635609651652988761843244","129183398218594732563669183607518171835","124542261778264939230247144608374179458","131959201071437047735461567067359683861","263331179615316229374639430846781345720","241334230864310589411062360466625524557","279818975687780595161395435796060722986","206117104796358918288773725712491279842","241900667577984039909083760605683164037","19716538418745415504441605192266300922","303989289864875489576962212426142289414","156823627325101426101672606156899644454","106805471092365509589030419286258791697","164199596443644900560918802956713404745","34372433238761698555107146070808093287","133150760250734418516604992728151148005","325531693245445647958823488344995824833","131142560575142139280433078206677530827","34018011815698563049780921326199869378","337784643481510313022209137732959190363","79036987450877773158074046189450355851","266162515467995189961498457760360063404","272693424090544598954558699980506162344","123057354090939374721400450004097674185","185904467724615903006289899363440254735","157107975894230188630734964144059379470","94664348248100437318018356944108349553","232298209765667738162336637601061111625","287325695681927417194802543881581099886","68268755721276322389944519846334878987","101801771382771950243026088623801097314","271607393559258798829306638225230547984","302616893366310331320169678332541897094","42021131440571034617070244461031549013","296998221145449405947481273656825449539","160288364404534507844270924729880718914","281024982790951519483666516853101438442","214192663624459004815797066849465775804","62290377622370227840947504560101211494","238139764883408423955954297098887011980","203552085481958716698276363602920498970","113027358268588638490271294898073629353","12881431467667139241515858908883236278","292968396920666118301750108957748882125","277534018551045347658380515016707343611","123269781805580336232448945223181236992","274120203374193031567331960132623700524","222042715484888392339929476066083326198","91409736980530548682659421357166737060","329117890962367979429073539225812899652","160129877919402811405583010848733881554","300060391170844190410168560144230457707","293512585678703194775601730981087436159","65844868891922895524819793607253772221","267906556246635428379685297058736128711","77744247070285436605577110273299451663","332480641275030038972437288452729807550","226350852187471562630413933527871052231","180606985592248973219386776036712828548","37983442806852937320266678477550138068","144765808228614312953795475573095659587","28425330574308016910598266199614178389","30216047885397868868616210664659285592","151612238712716840051648742301179546663","144438384913607450765464579749198614097","246320147545861192898328277781541532902","129348722189763160002396242026027676036","146568542357376046253911414393985490662","158288775440342915453204770681873387326","269362712245683287664849303146925809294","37813247294450240728209459126858675173","2143559306160618953948220990634537363","76380520805834164356284375609097451787","139438566208224799015281549997156545051","337378792921816476841952447959208440748","19204478166417220820221257172217150627","289036807231888463457999029347884960257","101678555110222609995026013915129459502","225774147597962850258567937969999166837","160813492402478369087385530324530134705","330441487483700884607605739975221059695","329570329803132140675524675813439079778","326848536114473719086885422681448389908"],"threshold":0.9},"id":"CVE-2026-15422-85bca7bb","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["80537080670745539003506799644158693591","72046834052053578727888011555191530875","75258882408810787984208484915313769486","74235520511775822966382308832896434576","24870651232605095596189995091725058700","42701370182815874337612569193773626341","23119427683246333775713941885958356348","35840881324344206290195745674068106859","235949416605863536888238983432277923389","268089874122099909760231285987610350691","139144405446838346954280248343985673444","301557583213195926356520741971907210654","269104301374897691119215341200185276940","198039566007188874823889488035173566769","59229493780733867816360440621132218291","335195166446524254327315207163008768988","36512815075057223192817498983394263836","131400107228173577403089610649687592242","285281558194913699894068188865255482796","195526742511825285608310871301225114097","250758367501339438195541760952960863209","66413719149987883613912942179971887019","248449890540878204876554309802855384608","215331918357984769912020096250844432837","278604022617100029791403096291847694609","46569523997620602276577088632757821680","4275193642427661854315886938346601000","159677943727072232709756433098455194203","16197688134385244899927228286440111426","190944468861777581089960843886487312944","26858874441006597972596608588433833145","37594220275392622589410347913458272069","260086572810364167035166016309962833354","213021519540099338853622145011002124975","76672943344475708362546324128433232950","305803745778791973964361632407265010578","80131320105444973491625337126786339245","282746365881838761113955571000321604982","58997326154625938241540801055413630374","159141972776269327863258230729165458132","96595767985218776499416917786001132038","85696161527867013504157565855166314305","162013940316506402468793561140384592903","57436490284803610789677553788924363741","112200715843328961642799669842699624718","138083037409570592338717192671047587268","199269274722594741431447482609236474953","143119704163643902801589898900428571746","65756692574787711952573922285632405641","15428463934921154607160999067712693780","325187847987576759058495324954043175532","166289942516508346776387956376343508965","107945289734942162716216612833841114957","283078361795539683006615979300669940011","167181428658221384291823254414149774881","296516070109966016784466405027386443110","276366014658794250345168766193593627005","73861924589007956658474865597178069299","324627311551129868250388697808321957239","197794846308698771458530030087900490875","159695287558958045596049786736340616977","158950994526405554103459497970134572917","307460603629842520404961054390676350800","92078068832365194872616435248395673400","69430412079567774731688938546409030770","126408091803051073517335388477655513680","167302281124262907651644386072711450193","215542764474669351216826173350711642631","249953318797410792240748385518831649173","119517227586452941108894068929818307990","51629100489107953617871787149246189106","192634292619744889081229015589765821359","81649249158964941418457981345802599833","120737931718845852082935243511577347043","30906338383704571390470656265867845817","273044645211350846033584871890401335473","86818778359962982396216399934684845655","254593961783228150221567920779128008197","52813634584062818323041635499984595329","303201522443930223998896196478214593839","16943432596783506856090829579568751431","26675340857299853548610025775299212414","144699112365425103794549802521233260775","123915051171306665140848859351252237645","20885471185949582935581468128404194040","213798971079038003770648207003802195740","271331316518837739814097715885662627106","46138128424404925466503248894952034435","148878751548825128877282562529377423324","115057637045908843170950951508533173525","50824239913021278079401675045639169361","108587633537507210242609878158511307392","84721599867579796399329802369367168398","49298002930204536841255210841186827767","86079255593886860754246617394274075072","288798805277611715029983841001606582388","271886300038145248786626948544245909022","48506561318929065571730648791182190757","129670928947580656689619246543889451826","292106881763804643698298796825409953236","83183106564140893672168108709924667955","181936993062657401247581025644932762368","174327644075076814627912956173998563786","42051257782520578784781609880867188481","182559914345611360839016687763303350553","197480799384823636430940064519390868083","51262302182409260669514138886552514365","289782664750983518949463960565658845404","261716235539447320624256830768308013717","143574265534902685962347336239272096715","180184572680613502536767407607058220915","210820787411451503436213061469298534831","18117987928981450173828524431021761990","127198052997768803919389908602505100243","169796118123716188634199458443169047625","320455913223804943482373018876003936319","255195299015740524485655183574217397516","2424943881312609582365447638861860367","105217755380291649829000643484182630487","169323707177001964916924047473212236989"],"threshold":0.9},"id":"CVE-2026-15422-8f7c7457","signature_type":"Line","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75","target":{"file":"usr/src/uts/common/inet/sctp/sctp_hash.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["251910662685572429178377142683056572836","306339822454880415587310296634367716535","256873748232959844568978667512293300694","32548107604311222989999008838395218179","209358930377157970885093264573754604782","98562544881133165317920194741860117828","301030520793127661323645399545939716479","248395037359430376788406224082034389299","217115132549938531731160006604542582276","7305954406763502478054547124653645646","307709115099650045124104862334511884241","163958569646631080791033242489259445891","246829483091919678930907915360182599602","141736686165419478820495924204267535671","196688390570438892255779309702581781653","141946745291748058180542733065858495874","333010591964289581227915507669197919146","325830131041001445814929444733727791633","139868115988195210013445589746428279545","223749043577621740248409284324945807704","26446783419661705970221444474943530323","125685440473813829169058903327429551728","291664206321316208210208925013928488205","123994922465293547035326884560252347338","317886849519342148281193243541668795735","154379944809291872061243329055759013622","58363601137877456402970009574851915126","125121947535864816968431604632477467391","242757839059903664448069811558257858665","209232241482017741189360964730761652692","124720394426972109349112784505239008822","179998694495325650673319290614884932160","201279798108320817173702798564045305173","215682641304156817971452448953190809177","286276069033163341329949795940355246512","261634177417335001101445691365940688895","207054970621256013422651474699798326221","125121947535864816968431604632477467391","242757839059903664448069811558257858665","209232241482017741189360964730761652692","124720394426972109349112784505239008822","179998694495325650673319290614884932160","240570697316464149218348354653345487414","129880587900906819769761777362316152059","128201903075237911820682974756739912082","251070582323273960317482510255286917922","279733101085409624508105234808019102170"],"threshold":0.9},"id":"CVE-2026-15422-b063598d","signature_type":"Line","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75","target":{"file":"usr/src/uts/common/inet/sctp/sctp_cookie.c"}},{"target":{"file":"usr/src/uts/common/inet/sctp/sctp_input.c","function":"sctp_ootb_input"},"deprecated":false,"digest":{"function_hash":"162228590646644292682986002594139425873","length":2356},"id":"CVE-2026-15422-bcdf3086","signature_type":"Function","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75"},{"deprecated":false,"digest":{"function_hash":"298849912339423010646720769926493797810","length":2035},"id":"CVE-2026-15422-f694dd8c","signature_type":"Function","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75","target":{"file":"usr/src/uts/common/inet/sctp/sctp_hash.c","function":"sctp_lookup_by_faddrs"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/S:P/AU:Y/R:U/V:C/RE:H/U:Red"}]}