[Bug 294989] pf: NULL pointer dereference in pf_sctp_multihome_detach_addr() via crafted pfsync state injection - Remote kernel panic

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D294989

--- Comment #5 from [email protected] ---
A commit in branch stable/15 references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=3D91d1c1c2b1e74e776641a0923a9796b01=
8c610d2

commit 91d1c1c2b1e74e776641a0923a9796b018c610d2
Author:     Kristof Provost <[email protected]>
AuthorDate: 2026-05-04 16:08:35 +0000
Commit:     Kristof Provost <[email protected]>
CommitDate: 2026-05-12 07:54:34 +0000

    pfsync: reject invalid SCTP states

    SCTP states should always have a src scrub object associated with them.
    Crafted pfsync packets might not have this, leading to us derferencing a
    NULL pointer on cleanup.

    Validate the pfsync state insertion packet to make sure this is correct.

    PR:             294989
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")

    (cherry picked from commit bf6d00afdb6171ba04a1c5a7fde904cde87d212d)

 sys/netpfil/pf/if_pfsync.c | 7 +++++++
 1 file changed, 7 insertions(+)

--=20
You are receiving this mail because:
You are the assignee for the bug.=