CVE-2026-15422: SCTP needs to better-check INIT ACK chunk parameters

Critical severity · published Jul 16, 2026

CVE-2026-15422

SCTP needs to better-check INIT ACK chunk parameters

9.1

CVSS

0.9%

EPSS

On KEV

Description

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.9% · higher than 59% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

OmniOS · OmniOS

r151058 before r151058j; r151056 before r151056aj; r151054 before r151054bj; any before r151054 · source: vendor

SmartOS · Triton Data Center

any before 202060709 · source: vendor