Junos OS on MX: infinite loop in netsctp.ko lets crafted SCTP traffic hang the device

CVSS 8.7CVE-2026-102046Firmware, BMC & network fabriccurated

Impact

Crafted SCTP traffic drives netsctp.ko into a loop with no exit condition, denying service on MX Series routers. This is a kernel module, so the hang takes the whole device rather than one daemon, and recovery is a reboot. On a router carrying cluster traffic toward storage or other sites, that is a hard outage for everything behind it. The exposure depends on the device processing SCTP at all - which on most datacenter MX deployments means it is reachable only if SCTP is in the configured service set.

Who can reach it

Network, unauthenticated. Any source that can deliver SCTP traffic to an MX Series router's control plane.

What to do

Upgrade to a fixed Junos release per Juniper advisory JSA112196; fixed versions for this issue are not in the record, so read the advisory for your train. The upgrade reboots the router. Interim mitigation is a control-plane filter that drops SCTP from untrusted sources, and disabling SCTP service where it is not required.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102046 https://supportportal.juniper.net/JSA112196

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.