Cloudanix VulnDB

CVE-2026-99128

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's network handling can make the system freeze when it receives certain malformed messages over SCTP connections.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Accepts SCTP chunks shorter than the required four-byte generic header in sctp_inq_pop(), allowing a zero-length ASCONF chunk to be returned repeatedly when SCTP-AUTH policy covers ASCONF and addip is enabled, causing the receive softirq to spin indefinitely.

Why it matters to the business

Systems running SCTP with addip_enable and auth_enable set can experience CPU soft lockups and loss of network responsiveness, leading to service outages and manual intervention on affected Linux kernels.

How an attack unfolds

A remote attacker establishes an SCTP association on a kernel with CONFIG_IP_SCTP, net.sctp.addip_enable=1 and net.sctp.auth_enable=1, then sends a single zero-length ASCONF chunk; the inqueue parser fails to reject it, sctp_assoc_bh_rcv() continues processing, and the chunk is replayed in a tight loop until the softirq watchdog fires.

How to fix it

Apply the kernel patch that rejects chunks shorter than four bytes at the sctp_inq_pop() boundary; rebuild with the fix and verify via the sctp_hello selftest for both IPv4 and IPv6.

How to confirm the fix worked

Confirm the presence of the length check before the state-machine path in sctp_inq_pop(); run the patched selftest and ensure no soft-lockup signatures appear after injecting a zero-length ASCONF.

Typical attack path

  1. Establish SCTP association with target
  2. Send zero-length ASCONF chunk under active AUTH policy
  3. Trigger repeated malformed chunk processing in softirq
  4. Induce CPU soft-lockup and service denial

How to detect it

Search kernel logs for repeated watchdog soft-lockup reports mentioning sctp or softirq; correlate with SCTP association setup events and ASCONF traffic around the time of the lockup.

  • watchdog soft-lockup
  • sctp_inq_pop
  • ASCONF

What your security team should do

  • Temporarily set net.sctp.addip_enable=0 or net.sctp.auth_enable=0 on exposed systems until patched
  • Prioritize kernel updates containing commit f967455fb2a5 and the sctp chunk-length validation fix
  • Enable kernel watchdog and SCTP logging to detect soft-lockup events

The record

In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctp_inq_pop() currently accepts shorter declared lengths. A zero-length chunk leaves chunk_end at the current header. When ASCONF is covered by the association's SCTP-AUTH policy, sctp_assoc_bh_rcv() can continue before the state machine performs its normal chunk-length check. sctp_inq_pop() then returns the same malformed chunk repeatedly and the receive softirq can lock up. A remote SCTP peer can trigger this after establishing an association on a kernel built with CONFIG_IP_SCTP and configured with net.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did not require application credentials, a shared SCTP AUTH key, or net.sctp.addip_noauth_enable=1. On commit f967455fb2a5 ("seg6: reset IP6CB after IPv6 decapsulation"), one zero-length ASCONF caused repeated watchdog soft-lockup reports in a two-vCPU KVM guest. All 3 pre-trigger health probes succeeded, while 36 of 37 post-trigger probes failed. With this change, all 37 post-trigger probes succeeded and no equivalent soft-lockup signature appeared. Reject chunks shorter than the generic SCTP header at the shared inqueue parser boundary. Mark the packet for discard before either caller can continue processing it, while preserving the four-byte generic minimum. Declared-length 1 through 4 controls and kernel-generated ASCONF traffic remained healthy. The patched sctp_hello selftest passed for IPv4 and IPv6. The complete private reproducer and validation evidence are available directly to maintainers on request.

Affected packages

Ecosystem Package Introduced Fixed