[Bug 294989] pf: NULL pointer dereference in pf_sctp_multihome_detach_addr() via crafted pfsync state injection - Remote kernel panic

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D294989

--- Comment #4 from [email protected] ---
A commit in branch stable/14 references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=3D8d583858e499dcc23a1c7b6b9c80e2e84=
f245d04

commit 8d583858e499dcc23a1c7b6b9c80e2e84f245d04
Author:     Kristof Provost <[email protected]>
AuthorDate: 2026-05-04 16:08:35 +0000
Commit:     Kristof Provost <[email protected]>
CommitDate: 2026-05-12 07:54:38 +0000

    pfsync: reject invalid SCTP states

    SCTP states should always have a src scrub object associated with them.
    Crafted pfsync packets might not have this, leading to us derferencing a
    NULL pointer on cleanup.

    Validate the pfsync state insertion packet to make sure this is correct.

    PR:             294989
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")

    (cherry picked from commit bf6d00afdb6171ba04a1c5a7fde904cde87d212d)

 sys/netpfil/pf/if_pfsync.c | 7 +++++++
 1 file changed, 7 insertions(+)

--=20
You are receiving this mail because:
You are the assignee for the bug.=