Description
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (infinite recursion and crash) via a packet that contains two or more DATA fragments, which causes an skb pointer to refer back to itself when the full message is reassembled, leading to infinite recursion in the sctp_skb_pull function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-source-2.4.27 | 2.4.27-10sarge3 | DSA-1097-1 |
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge3 | DSA-1103 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +8 | 2.6.9-34.0.1.EL | RHSA-2006:0493 |
Advisories 3
- RHSA-2006:0493 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1097-1 kernel-source-2.4.27 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1103 kernel-source-2.6.8 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm
- RHSA-2006:0493 vendor-advisory
- ADV-2006-2554 vdb-entry
- 17955 vdb-entry
- 20716 third-party-advisory
- 21476 third-party-advisory
- 21745 third-party-advisory
- MDKSA-2006:150 vendor-advisory
- USN-302-1 vendor-advisory
- MDKSA-2006:123 vendor-advisory
- DSA-1097 vendor-advisory
- SUSE-SA:2006:028 vendor-advisory
- http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=672e7cca17ed6036a1756ed34cf20dbd72d5e5f6
- 2006-0026 vendor-advisory
- DSA-1103 vendor-advisory
- linux-sctp-skb-pull-dos(26432) vdb-entry
- 21045 third-party-advisory
- 20237 third-party-advisory
- 20398 third-party-advisory
- 25746 vdb-entry
- oval:org.mitre.oval:def:9531 vdb-entry signature
- 20671 third-party-advisory
- 20914 third-party-advisory