Read the docs
TI-2026-12978 Aliases CVE-2026-15422GHSA-7fj7-gprr-x7fm

SCTP needs to better-check INIT ACK chunk parameters

Priority MEDIUM 49CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00882 59th percentileScored 2026-11-07
Fix Fixed OmniOS (OmniOS): r151058j, r151056aj, r151054bjSmartOS (Triton Data Center): 202060709

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OmniOSOmniOSr151058 to before r151058j; r151056 to before r151056aj; r151054 to before r151054bj; any to before r151054r151058j, r151056aj, r151054bjPatch availableCNA
Triton Data CenterSmartOSany to before 202060709202060709Patch availableCNA
  • OmniOS VendorOmniOS Affected r151058 to before r151058j; r151056 to before r151056aj; r151054 to before r151054bj; any to before r151054 Fixed in r151058j, r151056aj, r151054bj Patch available CNA
  • SmartOS VendorTriton Data Center Affected any to before 202060709 Fixed in 202060709 Patch available CNA

Remediation

  • Fix · CNA OmniOS (OmniOS) Fixed in r151058j, r151056aj, r151054bj
  • Fix · CNA SmartOS (Triton Data Center) Fixed in 202060709

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OmniOS r151054, r151054bj and 2 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-12996 TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruptionPriority LOW 25
    Show all 2 records →
  • Release ·

    Triton Data Center SmartOS 202060709

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-12996 TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruptionPriority LOW 25
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15422
  2. 2026-10-03 Alias added: GHSA-7fj7-gprr-x7fm

References

Patch 1

Other 2

  • TI-2012-00210 The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix… CVSS 2.0HIGH 7.2
  • TI-2021-19340 An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90… CVSS 3.1MEDIUM 5.5
  • TI-2020-16788 An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by… CVSS 3.1CRITICAL 9.8
  • TI-2016-05624 Improper input validation in illumos osnet-incorporation CVSS 3.0HIGH 8.6
  • TI-2019-06998 An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other… CVSS 3.1HIGH 8.1
  • TI-2016-05625 illumos smbsrv NULL pointer dereference allows system crash. CVSS 3.0HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences