Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

lksctp may crash Linux kernel with malformed SCTP packet

CVE-2006-2271 · published 20 years ago
Summary

The lksctp library used for SCTP networking on Linux can crash the entire system if it receives an unexpected data chunk while a connection is closed. This causes the operating system to stop working and requires a restart. Upgrade lksctp to a version newer than 2.6.17 or apply the available security patch to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
lksctp lksctp 2.6.0_test1_0.7.2
2.6.0_test4_0.7.3
2.6.2_0.9.0
2.6.3_1.0.0
2.6.6_1.0.1
2.6.10_1.0.2
2.6.13_1.0.3
2.6.14_1.0.4
2.6.15_1.0.5
2.6.16_1.0.6
cpe:2.3:a:lksctp:lksctp:2.6.0_test1_0.7.2:*:*:*:*:*:*:*
Original advisory text
The ECNE chunk handling in Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via an unexpected chunk when the session is in CLOSED state.
The ECNE chunk handling in Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via an unexpected chunk when the session is in CLOSED state.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.8 High
Exploitation
4% chance of attack within 30 days
Timeline
Published9 May 2006
Updated27 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-2271 · NVD
Track software like this
Free during beta