CVE-2026-98846

What it actually does

Use-after-free in SCTP caused by sctp_wait_for_connect dropping the socket lock, allowing an out-of-the-blue ABORT to unlink an association while a concurrent SHUT_RD sets RCV_SHUTDOWN; the waiter then returns without checking base.dead, so sctp_association_put frees the object and leaves sctp_sendmsg_to_asoc with a dangling pointer.

Why it matters to the business

Systems relying on SCTP may experience kernel crashes or memory corruption that lead to denial of service; the issue is only five days old with negligible exploit probability, so immediate risk to most environments remains low.

How an attack unfolds

An attacker sends an unexpected SCTP ABORT while a connect is sleeping in sctp_wait_for_connect; simultaneously a local or remote shutdown sets RCV_SHUTDOWN so the waiter exits with err==0, performs the final put that frees the association, and leaves the subsequent sendmsg path dereferencing the now-freed object.

How to fix it

Upgrade the Linux kernel to a version containing the referenced commit that adds the RCV_SHUTDOWN check in sctp_sendmsg_to_asoc before re-using the association; apply the fix as soon as vendor packages become available.

How to confirm the fix worked

Confirm the kernel source contains the added RCV_SHUTDOWN test alongside the wait error check; recompile or install the updated package and verify that sctp_sendmsg no longer proceeds after an ABORT-induced unlink during connect wait.

Typical attack path

1. Trigger sctp_sendmsg that enters sctp_wait_for_connect and drops the socket lock
2. Inject an out-of-the-blue ABORT that is processed from the backlog and unlinks the association
3. Cause or time a shutdown(fd, SHUT_RD) that sets RCV_SHUTDOWN on the socket
4. The waiter breaks early with err==0 and calls sctp_association_put, freeing the association
5. sctp_sendmsg_to_asoc continues and dereferences the dangling association pointer

How to detect it

Search kernel logs for SCTP association teardown messages immediately preceding oops or use-after-free warnings; examine auditd or syscall traces for concurrent shutdown and sendmsg calls on SCTP sockets around the time of a crash.

What your security team should do

• Monitor kernel update channels for the SCTP fix and schedule testing within normal patch windows given the low EPSS
• Restrict SCTP exposure to only trusted peers until patches are deployed
• Review any custom SCTP applications for explicit handling of association shutdown races