TI-2006-02216 Aliases CVE-2006-2275 GHSA-j2xg-37rj-vrf9

Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service…

LOW 39CWE-667Published 2006-05-09 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-667 and the CVSS impact.

Summary

Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quickly enough, which leads to "spillover of the receive buffer."

Why it matters now

EPSS 0.03602 89th percentileScored 2026-11-07

Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:lksctp:stream_control_transmission_protocol::::::::	before 2.6.17	Vulnerable	Lksctp
cpe:2.3:o:canonical:ubuntu_linux:5.04:::::::*	5.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:5.10:::::::*	5.10	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*	6.06	Vulnerable	Canonical

cpe:2.3:a:lksctp:stream_control_transmission_protocol:*:*:*:*:*:*:*:* Versions before 2.6.17 Vulnerable ·Lksctp
cpe:2.3:o:canonical:ubuntu_linux:5.04:*:*:*:*:*:*:* Versions 5.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:5.10:*:*:*:*:*:*:* Versions 5.10 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·Canonical

Remediation

Red Hat 1 advisory

RHSA-2006:0575 Released 2006-08-10 · Red Hat rating Important
Updated kernel packages available for Red Hat Enterprise Linux 4 Update 4
- Red Hat Enterprise Linux AS version 4 kernel-2.6.9-42.EL, kernel-2.6.9-42.EL.ia64, kernel-2.6.9-42.EL.ppc64iseries +12
- Red Hat Enterprise Linux Desktop version 4 kernel-2.6.9-42.EL, kernel-devel-2.6.9-42.EL, kernel-doc-2.6.9-42.EL +6
- Red Hat Enterprise Linux ES version 4 kernel-2.6.9-42.EL, kernel-2.6.9-42.EL.ia64, kernel-devel-2.6.9-42.EL +10
- Red Hat Enterprise Linux WS version 4 kernel-2.6.9-42.EL, kernel-2.6.9-42.EL.ia64, kernel-devel-2.6.9-42.EL +10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AS version 4	Fixed	RHSA-2006:0575
Red Hat Enterprise Linux Desktop version 4	Fixed	RHSA-2006:0575
Red Hat Enterprise Linux ES version 4	Fixed	RHSA-2006:0575
Red Hat Enterprise Linux WS version 4	Fixed	RHSA-2006:0575

Timeline

2026-10-02 Threatist record created from CVE-2006-2275
2026-10-03 Alias added: GHSA-j2xg-37rj-vrf9

References

Advisory 4

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences