CVE-2026-98548 - Vulnerability Details

- sctp: discard the rest of the packet on a stale-cookie error

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: discard the rest of the packet on a stale-cookie error

When an association is in COOKIE-ECHOED state and the peer sends a
bundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary
addresses, processing the ERROR chunk takes the non-fatal stale-cookie
retry path sctp_sf_do_5_2_6_stale(), which queues
SCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.
sctp_cmd_del_non_primary() removes every non-primary transport -
including the very transport this packet arrived on, which is still
referenced by the receive lookup and shared by all chunks of the
packet via chunk->transport.

sctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from
the removed transport, but right afterwards the bundled DATA chunk
makes sctp_assoc_bh_rcv() re-register
asoc->peer.last_data_from = chunk->transport unconditionally, undoing
the redirection with the just-removed transport.

Once the packet is done, the receive reference is dropped and the
transport is RCU-freed, while the surviving association keeps the
dangling last_data_from. A later FWD-TSN (or the delayed SACK timer)
makes sctp_gen_sack() dereference it (->param_flags and friends), and
sctp_make_sack()/sctp_outq_select_transport() may write to the freed
object and link it into the live transport list. This is a
use-after-free triggerable by any malicious SCTP peer (or a local
unprivileged user acting as one) with no capabilities required:

BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660
Read of size 4 at addr ffff88800e1e356c by task poc/115
Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <-
sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv
Allocated: sctp_transport_new <- sctp_assoc_add_peer <-
sctp_process_init (INIT-ACK processing)
Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core
(call_rcu queued by sctp_transport_put at end of sctp_rcv)
The buggy address is located 364 bytes inside of freed 1024-byte
region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k

Note that commit 03a9d10ecf71 ("sctp: drop a chunk if its transport
was removed") only covers the window between the receive lookup and
the chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog);
here the transport is removed *while* the packet is being processed,
by an earlier chunk of the same packet, so the drop in sctp_inq_push()
does not reach this path. Verified with the bundled [ERROR(Stale
Cookie)][DATA] + FWD-TSN reproducer: the KASAN report above still
fires with that commit applied, and is gone with this patch on top.

Fix it by discarding the rest of the packet on this path, as suggested
by Xin. After the stale-cookie ERROR has sent the association back to
COOKIE-WAIT and removed the non-primary transports, the remaining
chunks of the packet can only run against the restarted handshake
while referencing the removed arrival transport through
chunk->transport: besides the last_data_from registration above,
sctp_cmd_setup_t2() and the sctp_make_*() reply builders would also
copy that pointer into association-lifetime state that
sctp_assoc_rm_peer() has already sanitized. Let the peer retransmit
them, in line with what sctp_inq_push() does for chunks whose
transport was removed before processing.

Published: 2026-10-18

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free condition exists in the SCTP implementation of the Linux kernel when a stale‑cookie error occurs on a non‑primary address while the association is in COOKIE‑ECHOED state. The kernel mistakenly retains a reference to a transport that has already been freed, allowing subsequent SCTP packets to dereference or modify memory through the dangling pointer. By sending malformed SCTP packets, an attacker can trigger this memory corruption, potentially achieving arbitrary kernel‑level code execution.

Affected Systems

The affected product is the Linux kernel across all versions that lack the recent patch removing the stale‑cookie error pathway. The vendor is Linux. All kernel builds prior to the commit that discards the remainder of SCTP packets on a stale‑cookie error are vulnerable. No specific version list is supplied, so any installation that compiles without this patch must be considered at risk.

Risk and Exploitability

The CVSS score is 9.8, the EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the flaw by sending crafted SCTP traffic from a remote host, making the attack vector remote over the network. The use‑after‑free bug may lead to kernel‑level remote code execution if successfully exploited, though the low EPSS suggests exploitation opportunities are presently scarce.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 854c053c71459f8db7ef07db9cfa4eec5f5206f2
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 965e21ea16acb394d5e5801998ca9b0adc669665
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1cd246b214dc9acf4e2f11d58c035e1e672fe7d2
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d68c9287b3ca0d6faadc61fbcb18d1a6b5493321
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ec23855274a73906b02f0d124fefd9cb3c008b1d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6df536c5acbc0abd6f119d02e24f4a2ed97707f4
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4498467a8af06cfa3d71cb04bd7c4170dec8f449

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,854c053c71459f8db7ef07db9cfa4eec5f5206f2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,965e21ea16acb394d5e5801998ca9b0adc669665)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1cd246b214dc9acf4e2f11d58c035e1e672fe7d2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d68c9287b3ca0d6faadc61fbcb18d1a6b5493321)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ec23855274a73906b02f0d124fefd9cb3c008b1d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6df536c5acbc0abd6f119d02e24f4a2ed97707f4)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4498467a8af06cfa3d71cb04bd7c4170dec8f449)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	generic	—
`[5.10.271,5.11.0]`	unaffected	semver	—
`[5.15.222,5.16.0]`	unaffected	semver	—
`[6.1.189,6.2.0]`	unaffected	semver	—
`[6.6.158,6.7.0]`	unaffected	semver	—
`[6.12.112,6.13.0]`	unaffected	semver	—
`[6.18.55,6.19.0]`	unaffected	semver	—
`[7.2.9,7.3.0]`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel update that includes the fix or rebuild the kernel with the patch applied
If an update cannot be applied immediately, disable SCTP support by removing or blacklisting the ip_sctp module, or blocking SCTP traffic
Continuously monitor kernel logs for use‑after‑free errors and ensure no SCTP services are exposed to external networks

Generated by OpenCVE AI on October 24, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00694.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98548.mbox
https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2
https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449
https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4
https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2
https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665
https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a
https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321
https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d
https://nvd.nist.gov/vuln/detail/CVE-2026-98548
https://www.cve.org/CVERecord?id=CVE-2026-98548

History

Sat, 24 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Tue, 20 Oct 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98548.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98548 https://www.cve.org/CVERecord?id=CVE-2026-98548
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sun, 18 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary addresses, processing the ERROR chunk takes the non-fatal stale-cookie retry path sctp_sf_do_5_2_6_stale(), which queues SCTP_CMD_DEL_NON_PRIMARY while keeping the association alive. sctp_cmd_del_non_primary() removes every non-primary transport - including the very transport this packet arrived on, which is still referenced by the receive lookup and shared by all chunks of the packet via chunk->transport. sctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from the removed transport, but right afterwards the bundled DATA chunk makes sctp_assoc_bh_rcv() re-register asoc->peer.last_data_from = chunk->transport unconditionally, undoing the redirection with the just-removed transport. Once the packet is done, the receive reference is dropped and the transport is RCU-freed, while the surviving association keeps the dangling last_data_from. A later FWD-TSN (or the delayed SACK timer) makes sctp_gen_sack() dereference it (->param_flags and friends), and sctp_make_sack()/sctp_outq_select_transport() may write to the freed object and link it into the live transport list. This is a use-after-free triggerable by any malicious SCTP peer (or a local unprivileged user acting as one) with no capabilities required: BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660 Read of size 4 at addr ffff88800e1e356c by task poc/115 Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <- sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv Allocated: sctp_transport_new <- sctp_assoc_add_peer <- sctp_process_init (INIT-ACK processing) Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core (call_rcu queued by sctp_transport_put at end of sctp_rcv) The buggy address is located 364 bytes inside of freed 1024-byte region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k Note that commit 03a9d10ecf71 ("sctp: drop a chunk if its transport was removed") only covers the window between the receive lookup and the chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog); here the transport is removed while the packet is being processed, by an earlier chunk of the same packet, so the drop in sctp_inq_push() does not reach this path. Verified with the bundled [ERROR(Stale Cookie)][DATA] + FWD-TSN reproducer: the KASAN report above still fires with that commit applied, and is gone with this patch on top. Fix it by discarding the rest of the packet on this path, as suggested by Xin. After the stale-cookie ERROR has sent the association back to COOKIE-WAIT and removed the non-primary transports, the remaining chunks of the packet can only run against the restarted handshake while referencing the removed arrival transport through chunk->transport: besides the last_data_from registration above, sctp_cmd_setup_t2() and the sctp_make_*() reply builders would also copy that pointer into association-lifetime state that sctp_assoc_rm_peer() has already sanitized. Let the peer retransmit them, in line with what sctp_inq_push() does for chunks whose transport was removed before processing.
Title		sctp: discard the rest of the packet on a stale-cookie error
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2 https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449 https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4 https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2 https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665 https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321 https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:18:16.510Z

Updated: 2026-10-24T14:09:21.243Z

Reserved: 2026-09-25T10:25:14.356Z

Link: CVE-2026-98548

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:06.767

Modified: 2026-10-24T14:16:46.943

Link: CVE-2026-98548

Redhat

Severity : Important

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98548 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T15:45:07Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object