External risk intelligence

Linux Kernel SCTP INIT Verification Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72398

This vulnerability affects the SCTP protocol implementation within the Linux kernel. SCTP is a transport-layer protocol often used for network services and communications that are frequently exposed to the internet, particularly in telecom, signaling, or high-performance networking environments where such endpoints are commonly reachable.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a flaw in how the Linux kernel handles secure data transmission protocols when certain security features are disabled. The issue could potentially allow for the processing of untrusted data, impacting the integrity of communications. The main concern is confirming relevance and exposure within your environment.

Vulnerability in secure data transmission, needs verification.
Matters if unauthenticated remote access is possible.
Confirm if this protocol is in use and exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted network packet to a system running a vulnerable Linux kernel. This packet would attempt to trick the system into accepting a malicious connection initiation by manipulating data within the SCTP handshake process, particularly when cookie authentication is disabled. Successful exploitation could allow the attacker to disrupt system operations or potentially gain unauthorized access.

Unauthenticated network access required.
Malicious SCTP handshake packets trigger vulnerability.
Risks include data corruption and denial of service.

Live Threat

Current exploitation, exposure, and threat context

When cookie authentication is disabled, a server processing a reconstructed SCTP INIT chunk could be tricked into accepting tampered data, potentially leading to an insecure association.

Network service availability and integrity.
Tampered INIT chunk processing.
Denial of service or unexpected behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's SCTP implementation requires immediate attention. Infrastructure or platform teams are likely responsible for the kernel, but the specific application owners leveraging SCTP must be identified. The first practical step is to determine where SCTP is used, assess its exposure, and confirm its criticality to business operations.

Identify and assess SCTP usage.
Confirm business criticality and owner.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SCTP component?

SCTP, or Stream Control Transmission Protocol, is a transport-layer protocol within the Linux kernel. It acts like a foundation for network communication, similar to TCP or UDP, but is specifically engineered for high-performance and reliable signaling, often used in telecommunications and complex data-transfer environments.

What is the vulnerability in CVE-2026-72398?

This vulnerability involves a logic flaw in how the kernel validates connection data. It falls under a weakness class related to improper input validation during the SCTP handshake. Specifically, when certain security features are turned off, the system fails to re-verify incoming data after it has been unpacked, potentially allowing the kernel to process untrusted or tampered information.

How can an attacker trigger this vulnerability?

An attacker must send a specially crafted network packet during the SCTP handshake process. The bug specifically triggers when cookie authentication is disabled, as the server incorrectly trusts reconstructed data. If cookie authentication is properly enabled, the contents are cryptographically protected and verified, which prevents this specific path of exploitation.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a significant concern because SCTP is frequently used for internet-facing services. If you run network endpoints that utilize SCTP in environments like telecom or high-performance signaling, your system is more likely to be reachable by external attackers and therefore at higher risk.

What steps should I take to respond to this issue?

Begin by auditing your infrastructure to identify which systems are currently utilizing the SCTP protocol. Once identified, evaluate whether these services are exposed to the network and determine their criticality to your operations. Coordinate with your platform or kernel engineering teams to prioritize the assessment of these specific assets.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.