CVE-2026-15422
- Source
- https://cve.org/CVERecord?id=CVE-2026-15422
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15422.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-15422
- Published
- 2026-07-16T19:29:13Z
- Modified
- 2026-09-04T08:05:21Z
- Severity
-
- 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/S:P/AU:Y/R:U/V:C/RE:H/U:Red CVSS Calculator
- Summary
- SCTP needs to better-check INIT ACK chunk parameters
- Details
-
The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.
- Database specific
{ "cna_assigner": "illumos", "cwe_ids": [ "CWE-122", "CWE-787" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15422.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "a5407c02d5ed61b29481b9b71f1307d7ebec9e5c" }, { "fixed": "53a3efdeff8e6745bbfb69c5360f94962fb79e75" }, { "introduced": "r151058" }, { "fixed": "r151058j" }, { "introduced": "r151056" }, { "fixed": "r151056aj" }, { "introduced": "r151054" }, { "fixed": "r151054bj" }, { "introduced": "any" }, { "fixed": "r151054" }, { "introduced": "any" }, { "fixed": "202060709" } ], "source": "AFFECTED_FIELD" }, { "extracted_events": [ { "introduced": "i.e" } ], "source": "DESCRIPTION" } ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15422.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-15422
- https://illumos.org/issues/18117
- https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75
- https://github.com/illumos/illumos-gate
- https://illumos.topicbox.com/groups/developer/Ta1a8e2e1f7f928df/18117-sctp-needs-to-better-check-init-ack-chunk-parameters
Affected packages
Git / github.com/illumos/illumos-gate
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15422.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "30902740663041772675893224636674900715",
"length": 1536
},
"id": "CVE-2026-15422-2c1c8989",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
"target": {
"file": "usr/src/uts/common/inet/sctp/sctp_cookie.c",
"function": "sctp_addrlist2sctp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "324183870454557879017208925348142661426",
"length": 14063
},
"id": "CVE-2026-15422-2f695e47",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
"target": {
"file": "usr/src/uts/common/inet/sctp/sctp_input.c",
"function": "sctp_input_data"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"31250796518563773150558368498007695814",
"326793976049523642264567736353462661967",
"241255432121403975036081614120009011360",
"15391210411914908648776739741145100879",
"32386853272965417843634239669040629477",
"28115316761538356278935314249841268216",
"165123251668551396677332437080823512889",
"12127090190239809391843306958718451860",
"199163544633566990460348635504921068522",
"88181191378388852376755923320437460043",
"120315210042048090646101245353185751079",
"159918955648261573879202742156449803142",
"200638116558420236765880029619873126990",
"320513705672239885837281653236548173253",
"55865678848412173784235435085396038599",
"239116539363378177302762392226693016441",
"266403843622659414371935227268610223276",
"66686073836534716317204559567640873735",
"244233182505513738017198078588534243592",
"11765248141063405749077717721339480301",
"276508587060158572827087662095917481819",
"84324256971808284376125764891263110939",
"163747286605233073109437461595745337287",
"234703681428180026724910240627704939098",
"87168392264891166737409386777745377384",
"7133466869396674114394073474046654988",
"209184881076845525022944384523651372403",
"74040463965236250874622052807073489065",
"3261714018886918249076388110314439379",
"97836451141507901406762710042105795095",
"119721574017292207149380623117283826303",
"336190601633813952230927457718946110181",
"61011245061122057961065087562457112220",
"217988674884642187749054764602109527610",
"89398614758121888080644472969660556958",
"271679738764421003854360707503382290219"
],
"threshold": 0.9
},
"id": "CVE-2026-15422-319eb8a2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
"target": {
"file": "usr/src/uts/common/inet/sctp/sctp_impl.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "318166070427195765407328075032979170612",
"length": 1979
},
"id": "CVE-2026-15422-513bb683",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
"target": {
"file": "usr/src/uts/common/inet/sctp/sctp_input.c",
"function": "sctp_check_input"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "286673733422841101854067237543898662460",
"length": 739
},
"id": "CVE-2026-15422-607ed5ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
"target": {
"file": "usr/src/uts/common/inet/sctp/sctp_hash.c",
"function": "sctp_fanout"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"251910662685572429178377142683056572836",
"177255137536229051349162066813837843506",
"11776340839431635609651652988761843244",
"129183398218594732563669183607518171835",
"124542261778264939230247144608374179458",
"131959201071437047735461567067359683861",
"263331179615316229374639430846781345720",
"241334230864310589411062360466625524557",
"279818975687780595161395435796060722986",
"206117104796358918288773725712491279842",
"241900667577984039909083760605683164037",
"19716538418745415504441605192266300922",
"303989289864875489576962212426142289414",
"156823627325101426101672606156899644454",
"106805471092365509589030419286258791697",
"164199596443644900560918802956713404745",
"34372433238761698555107146070808093287",
"133150760250734418516604992728151148005",
"325531693245445647958823488344995824833",
"131142560575142139280433078206677530827",
"34018011815698563049780921326199869378",
"337784643481510313022209137732959190363",
"79036987450877773158074046189450355851",
"266162515467995189961498457760360063404",
"272693424090544598954558699980506162344",
"123057354090939374721400450004097674185",
"185904467724615903006289899363440254735",
"157107975894230188630734964144059379470",
"94664348248100437318018356944108349553",
"232298209765667738162336637601061111625",
"287325695681927417194802543881581099886",
"68268755721276322389944519846334878987",
"101801771382771950243026088623801097314",
"271607393559258798829306638225230547984",
"302616893366310331320169678332541897094",
"42021131440571034617070244461031549013",
"296998221145449405947481273656825449539",
"160288364404534507844270924729880718914",
"281024982790951519483666516853101438442",
"214192663624459004815797066849465775804",
"62290377622370227840947504560101211494",
"238139764883408423955954297098887011980",
"203552085481958716698276363602920498970",
"113027358268588638490271294898073629353",
"12881431467667139241515858908883236278",
"292968396920666118301750108957748882125",
"277534018551045347658380515016707343611",
"123269781805580336232448945223181236992",
"274120203374193031567331960132623700524",
"222042715484888392339929476066083326198",
"91409736980530548682659421357166737060",
"329117890962367979429073539225812899652",
"160129877919402811405583010848733881554",
"300060391170844190410168560144230457707",
"293512585678703194775601730981087436159",
"65844868891922895524819793607253772221",
"267906556246635428379685297058736128711",
"77744247070285436605577110273299451663",
"332480641275030038972437288452729807550",
"226350852187471562630413933527871052231",
"180606985592248973219386776036712828548",
"37983442806852937320266678477550138068",
"144765808228614312953795475573095659587",
"28425330574308016910598266199614178389",
"30216047885397868868616210664659285592",
"151612238712716840051648742301179546663",
"144438384913607450765464579749198614097",
"246320147545861192898328277781541532902",
"129348722189763160002396242026027676036",
"146568542357376046253911414393985490662",
"158288775440342915453204770681873387326",
"269362712245683287664849303146925809294",
"37813247294450240728209459126858675173",
"2143559306160618953948220990634537363",
"76380520805834164356284375609097451787",
"139438566208224799015281549997156545051",
"337378792921816476841952447959208440748",
"19204478166417220820221257172217150627",
"289036807231888463457999029347884960257",
"101678555110222609995026013915129459502",
"225774147597962850258567937969999166837",
"160813492402478369087385530324530134705",
"330441487483700884607605739975221059695",
"329570329803132140675524675813439079778",
"326848536114473719086885422681448389908"
],
"threshold": 0.9
},
"id": "CVE-2026-15422-85bca7bb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
"target": {
"file": "usr/src/uts/common/inet/sctp/sctp_input.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"80537080670745539003506799644158693591",
"72046834052053578727888011555191530875",
"75258882408810787984208484915313769486",
"74235520511775822966382308832896434576",
"24870651232605095596189995091725058700",
"42701370182815874337612569193773626341",
"23119427683246333775713941885958356348",
"35840881324344206290195745674068106859",
"235949416605863536888238983432277923389",
"268089874122099909760231285987610350691",
"139144405446838346954280248343985673444",
"301557583213195926356520741971907210654",
"269104301374897691119215341200185276940",
"198039566007188874823889488035173566769",
"59229493780733867816360440621132218291",
"335195166446524254327315207163008768988",
"36512815075057223192817498983394263836",
"131400107228173577403089610649687592242",
"285281558194913699894068188865255482796",
"195526742511825285608310871301225114097",
"250758367501339438195541760952960863209",
"66413719149987883613912942179971887019",
"248449890540878204876554309802855384608",
"215331918357984769912020096250844432837",
"278604022617100029791403096291847694609",
"46569523997620602276577088632757821680",
"4275193642427661854315886938346601000",
"159677943727072232709756433098455194203",
"16197688134385244899927228286440111426",
"190944468861777581089960843886487312944",
"26858874441006597972596608588433833145",
"37594220275392622589410347913458272069",
"260086572810364167035166016309962833354",
"213021519540099338853622145011002124975",
"76672943344475708362546324128433232950",
"305803745778791973964361632407265010578",
"80131320105444973491625337126786339245",
"282746365881838761113955571000321604982",
"58997326154625938241540801055413630374",
"159141972776269327863258230729165458132",
"96595767985218776499416917786001132038",
"85696161527867013504157565855166314305",
"162013940316506402468793561140384592903",
"57436490284803610789677553788924363741",
"112200715843328961642799669842699624718",
"138083037409570592338717192671047587268",
"199269274722594741431447482609236474953",
"143119704163643902801589898900428571746",
"65756692574787711952573922285632405641",
"15428463934921154607160999067712693780",
"325187847987576759058495324954043175532",
"166289942516508346776387956376343508965",
"107945289734942162716216612833841114957",
"283078361795539683006615979300669940011",
"167181428658221384291823254414149774881",
"296516070109966016784466405027386443110",
"276366014658794250345168766193593627005",
"73861924589007956658474865597178069299",
"324627311551129868250388697808321957239",
"197794846308698771458530030087900490875",
"159695287558958045596049786736340616977",
"158950994526405554103459497970134572917",
"307460603629842520404961054390676350800",
"92078068832365194872616435248395673400",
"69430412079567774731688938546409030770",
"126408091803051073517335388477655513680",
"167302281124262907651644386072711450193",
"215542764474669351216826173350711642631",
"249953318797410792240748385518831649173",
"119517227586452941108894068929818307990",
"51629100489107953617871787149246189106",
"192634292619744889081229015589765821359",
"81649249158964941418457981345802599833",
"120737931718845852082935243511577347043",
"30906338383704571390470656265867845817",
"273044645211350846033584871890401335473",
"86818778359962982396216399934684845655",
"254593961783228150221567920779128008197",
"52813634584062818323041635499984595329",
"303201522443930223998896196478214593839",
"16943432596783506856090829579568751431",
"26675340857299853548610025775299212414",
"144699112365425103794549802521233260775",
"123915051171306665140848859351252237645",
"20885471185949582935581468128404194040",
"213798971079038003770648207003802195740",
"271331316518837739814097715885662627106",
"46138128424404925466503248894952034435",
"148878751548825128877282562529377423324",
"115057637045908843170950951508533173525",
"50824239913021278079401675045639169361",
"108587633537507210242609878158511307392",
"84721599867579796399329802369367168398",
"49298002930204536841255210841186827767",
"86079255593886860754246617394274075072",
"288798805277611715029983841001606582388",
"271886300038145248786626948544245909022",
"48506561318929065571730648791182190757",
"129670928947580656689619246543889451826",
"292106881763804643698298796825409953236",
"83183106564140893672168108709924667955",
"181936993062657401247581025644932762368",
"174327644075076814627912956173998563786",
"42051257782520578784781609880867188481",
"182559914345611360839016687763303350553",
"197480799384823636430940064519390868083",
"51262302182409260669514138886552514365",
"289782664750983518949463960565658845404",
"261716235539447320624256830768308013717",
"143574265534902685962347336239272096715",
"180184572680613502536767407607058220915",
"210820787411451503436213061469298534831",
"18117987928981450173828524431021761990",
"127198052997768803919389908602505100243",
"169796118123716188634199458443169047625",
"320455913223804943482373018876003936319",
"255195299015740524485655183574217397516",
"2424943881312609582365447638861860367",
"105217755380291649829000643484182630487",
"169323707177001964916924047473212236989"
],
"threshold": 0.9
},
"id": "CVE-2026-15422-8f7c7457",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
"target": {
"file": "usr/src/uts/common/inet/sctp/sctp_hash.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"251910662685572429178377142683056572836",
"306339822454880415587310296634367716535",
"256873748232959844568978667512293300694",
"32548107604311222989999008838395218179",
"209358930377157970885093264573754604782",
"98562544881133165317920194741860117828",
"301030520793127661323645399545939716479",
"248395037359430376788406224082034389299",
"217115132549938531731160006604542582276",
"7305954406763502478054547124653645646",
"307709115099650045124104862334511884241",
"163958569646631080791033242489259445891",
"246829483091919678930907915360182599602",
"141736686165419478820495924204267535671",
"196688390570438892255779309702581781653",
"141946745291748058180542733065858495874",
"333010591964289581227915507669197919146",
"325830131041001445814929444733727791633",
"139868115988195210013445589746428279545",
"223749043577621740248409284324945807704",
"26446783419661705970221444474943530323",
"125685440473813829169058903327429551728",
"291664206321316208210208925013928488205",
"123994922465293547035326884560252347338",
"317886849519342148281193243541668795735",
"154379944809291872061243329055759013622",
"58363601137877456402970009574851915126",
"125121947535864816968431604632477467391",
"242757839059903664448069811558257858665",
"209232241482017741189360964730761652692",
"124720394426972109349112784505239008822",
"179998694495325650673319290614884932160",
"201279798108320817173702798564045305173",
"215682641304156817971452448953190809177",
"286276069033163341329949795940355246512",
"261634177417335001101445691365940688895",
"207054970621256013422651474699798326221",
"125121947535864816968431604632477467391",
"242757839059903664448069811558257858665",
"209232241482017741189360964730761652692",
"124720394426972109349112784505239008822",
"179998694495325650673319290614884932160",
"240570697316464149218348354653345487414",
"129880587900906819769761777362316152059",
"128201903075237911820682974756739912082",
"251070582323273960317482510255286917922",
"279733101085409624508105234808019102170"
],
"threshold": 0.9
},
"id": "CVE-2026-15422-b063598d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
"target": {
"file": "usr/src/uts/common/inet/sctp/sctp_cookie.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "162228590646644292682986002594139425873",
"length": 2356
},
"id": "CVE-2026-15422-bcdf3086",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
"target": {
"file": "usr/src/uts/common/inet/sctp/sctp_input.c",
"function": "sctp_ootb_input"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "298849912339423010646720769926493797810",
"length": 2035
},
"id": "CVE-2026-15422-f694dd8c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
"target": {
"file": "usr/src/uts/common/inet/sctp/sctp_hash.c",
"function": "sctp_lookup_by_faddrs"
}
}
]
vanir_signatures_modified
"2026-09-04T08:05:21Z"