CVE-2026-23125: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23125 is a NULL pointer dereference vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. The flaw exists in the SCTP transmit path when SCTP-AUTH key initialization fails during INIT_ACK processing in sctp_sf_do_5_1C_ack(). It affects Linux kernel versions from 2.6.24 through multiple stable branches, with fixed versions at 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, and 6.18.8, as well as 6.19-rc1 through rc6. The vulnerability was published on February 14, 2026, with patches released on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Kernel Patches).

The root cause is a NULL pointer dereference (CWE-476) caused by improper command sequencing in the SCTP state machine side-effect interpreter. In sctp_sf_do_5_1C_ack(), the command SCTP_CMD_ASSOC_SHKEY — responsible for initializing the association's shared authentication key — is executed after timer operations (SCTP_CMD_TIMER_STOP, SCTP_CMD_TIMER_START). If sctp_auth_asoc_init_active_key() fails, asoc->shkey remains NULL while the peer's authentication capability has already been recorded. This allows a DATA chunk with authentication enabled but no valid key to be queued and transmitted, triggering a null pointer dereference in sctp_packet_bundle_auth() at net/sctp/output.c:264. The fix reorders the command sequence to execute SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT, ensuring that a key generation failure aborts the sequence before timer operations proceed (Feedly, Kernel Patches).

Successful exploitation results in a kernel crash (kernel panic / NULL pointer dereference), causing a local denial of service that affects system availability entirely. There is no confidentiality or integrity impact — the vulnerability is limited to availability (A:H, C:N, I:N). An attacker with local access and low privileges can crash the kernel by triggering a failure in SCTP-AUTH shared key initialization during INIT_ACK processing, potentially disrupting all services running on the affected system (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Administrators should update to the following minimum versions: 5.10.249+, 5.15.199+, 6.1.162+, 6.6.122+, 6.12.68+, or 6.18.8+. Patch commits are available at git.kernel.org (commits: 0c4adb1f391a, 5a309bedf02e, 784428ab1889, a80c9d945aef, bf2b543b3cc4, e7e81abbcc56, e94294798548). Downstream distributions including Ubuntu (USN-8162-1, USN-8180-x series, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1), Amazon Linux 2, Oracle Linux, SUSE, and openSUSE have also issued updated kernel packages. Systems using SCTP with authentication (SCTP-AUTH) should prioritize patching (Feedly, Ubuntu USN-8180-1, AWS ALAS).

The vulnerability has been picked up by standard Linux security advisory channels including Ubuntu Security Notices, Amazon Linux Security Advisories, Oracle Linux errata, SUSE advisories, and openSUSE security announcements. Coverage has been largely routine, consistent with a medium-severity local kernel DoS fix. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and patch notification channels (Ubuntu USN-8180-1, AWS ALAS).