CVE-2026-89476 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using SCTP, should assess exposure and prioritize remediation. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and availability of Linux kernel-based systems.

Why it matters

The vulnerability in the Linux kernel's SCTP implementation could allow an attacker to cause a denial of service. Defenders responsible for Linux kernel-based systems, particularly those using SCTP, should assess exposure and prioritize remediation.

• Denial of service attacks may be possible
• Remediation priority is medium due to potential impact on system availability

Technical summary

The Linux kernel's SCTP implementation has a vulnerability that could allow an attacker to cause an underflow in the stream->outcnt variable. This is caused by a cached RECONF chunk containing more than one request parameter, allowing a duplicate response to process the same ADD_OUT request again while another parameter is still outstanding. To address this vulnerability, defenders should assess exposure and prioritize remediation for systems using the affected Linux kernel versions. The vulnerability can be mitigated by reviewing and applying the Linux kernel patches provided.

Defensive priority

Medium

Recommended defensive actions

• Assess exposure and prioritize remediation for systems using the affected Linux kernel versions
• Review and apply the Linux kernel patches provided
• Monitor for potential denial of service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE Program record and the NVD vulnerability detail page. The Linux kernel patch is available at https://git.kernel.org/stable/c/2d867663c563e8009257b9edf9c8ec75d9bbf19a and other referenced commits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.