sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT

{
  "id": "9de80fa6d1043243ccc7995091cd4fc90fd55cd9df1c3ca500fcfe8e81fdd0e3",
  "url": "https://osv.dev/vulnerability/CVE-2026-23125",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ================================================================== KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2 RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline] RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401 Call Trace: sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189 sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111 sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217 sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787 sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline] sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169 sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052 sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88 sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243 sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127 The issue is triggered when sctp_auth_asoc_init_active_key() fails in sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the command sequence is currently: - SCTP_CMD_PEER_INIT - SCTP_CMD_TIMER_STOP (T1_INIT) - SCTP_CMD_TIMER_START (T1_COOKIE) - SCTP_CMD_NEW_STATE (COOKIE_ECHOED) - SCTP_CMD_ASSOC_SHKEY - SCTP_CMD_GEN_COOKIE_ECHO If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey",
    "evidence": "osv:CVE-2026-23125",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.249",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.199",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.162",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.122",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.68",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.8",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-23125",
      "aliases": [
        "CVE-2026-23125"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5"
                },
                {
                  "fixed": "5a309bedf02ee08b0653215f06c94d61ec7a214a"
                },
                {
                  "fixed": "784428ab1889eb185a1459e9d6bc52df33d572ef"
                },
                {
                  "fixed": "e94294798548e8cfbd80869e1d2f97efce92582c"
                },
                {
                  "fixed": "e7e81abbcc5620c9532080538f9709a6ea382855"
                },
                {
                  "fixed": "bf2b543b3cc4ebb4ab5bca4f8dfa5612035d45b8"
                },
                {
                  "fixed": "0c4adb1f391a7b92a0405e9d7c05624c0d9f8a65"
                },
                {
                  "fixed": "a80c9d945aef55b23b54838334345f20251dad83"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23125.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "2.6.24"
                },
                {
                  "fixed": "5.10.249"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.199"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.162"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.122"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.68"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.8"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23125.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:50.245779354Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/0c4adb1f391a7b92a0405e9d7c05624c0d9f8a65",
        "https://git.kernel.org/stable/c/5a309bedf02ee08b0653215f06c94d61ec7a214a",
        "https://git.kernel.org/stable/c/784428ab1889eb185a1459e9d6bc52df33d572ef",
        "https://git.kernel.org/stable/c/a80c9d945aef55b23b54838334345f20251dad83",
        "https://git.kernel.org/stable/c/bf2b543b3cc4ebb4ab5bca4f8dfa5612035d45b8",
        "https://git.kernel.org/stable/c/e7e81abbcc5620c9532080538f9709a6ea382855",
        "https://git.kernel.org/stable/c/e94294798548e8cfbd80869e1d2f97efce92582c",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23125.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-23125",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23125.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-23125",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 518954,
  "published_at": "2026-02-14T15:09:54.756+00:00"
}