CVE-2026-98586

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing flaw in the Linux kernel's network code could let an attacker crash systems or run code with higher privileges when certain network features are in use.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Moderate
Impact: Denial Of Service
Component: OS kernel
Class: Race Condition
Remediation: Patch
Effort: Medium
Patch risk: Low

What it actually does

Race condition in SCTP timer handlers allows mod_timer to be called without holding the required association or transport reference, enabling a window where cleanup drops the reference and the handler operates on a freed object, resulting in refcount underflow and use-after-free.

Why it matters to the business

Linux systems using SCTP networking face risk of kernel instability, crashes, or potential privilege escalation; although currently unexploited in the wild, the low but non-zero exploit probability requires prompt patching to avoid future availability or security incidents.

How an attack unfolds

An attacker triggers SCTP protocol activity that schedules timers, races the mod_timer call with timer deletion and reference cleanup outside the socket lock, then causes the handler to dereference the now-freed object after the underflow.

How to fix it

Upgrade the Linux kernel to a version containing the fix that ensures the association or transport reference is acquired before mod_timer and properly dropped when the timer was already pending; apply the same ordering change to the proto-unreachable path.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit; inspect SCTP timer handler source for the reference acquisition before mod_timer; test under concurrent timer delete and re-arm workloads.

Typical attack path

Establish or manipulate an SCTP association to activate timer paths
Force concurrent timer deletion and re-arm without socket lock held
Trigger the handler after the object has been freed
Exploit the resulting refcount underflow for memory corruption

How to detect it

Review kernel logs for SCTP refcount underflow warnings or use-after-free oops; correlate with SCTP association teardown events; examine network traces for unusual SCTP timer-related packet patterns around crash times.

What your security team should do

Prioritize kernel updates for all systems exposing SCTP sockets
Monitor upstream stable branches for the backported fix
Restrict SCTP usage to trusted networks until patched
Review any custom SCTP timer or association handling code

The record

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before mod_timer() in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls mod_timer() before taking the reference needed by the rearmed timer without holding the sock lock. This creates a race with timer cleanup: if the timer is deleted after mod_timer() returns but before the reference is taken, the cleanup path can drop the timer's reference and destroy the transport or association. The timer handler then takes a reference on the already freed object and eventually drops it, causing a refcount underflow. Hold the object before mod_timer() and drop the reference if mod_timer() reports that the timer was already pending in timer handlers. Apply the same ordering to the proto-unreachable path, which can rearm a transport timer outside the timer handlers without holding the sock lock.

Affected packages

Ecosystem	Package	Introduced	Fixed