CVE-2026-98586
Received Received - Intake

Use-After-Free in Linux Kernel SCTP

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before mod_timer() in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls mod_timer() before taking the reference needed by the rearmed timer without holding the sock lock. This creates a race with timer cleanup: if the timer is deleted after mod_timer() returns but before the reference is taken, the cleanup path can drop the timer's reference and destroy the transport or association. The timer handler then takes a reference on the already freed object and eventually drops it, causing a refcount underflow. Hold the object before mod_timer() and drop the reference if mod_timer() reports that the timer was already pending in timer handlers. Apply the same ordering to the proto-unreachable path, which can rearm a transport timer outside the timer handlers without holding the sock lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98586
EUVD
EUVD-2026-103631

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 2.6.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a race condition occurs in SCTP protocol timer handlers. The issue involves rearming timers without properly holding references to the association or transport objects first. This can lead to a reference count underflow when the timer is cleaned up before the reference is taken, causing use-after-free scenarios.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCTP implementation and requires kernel code analysis or runtime detection. No direct network or system commands can detect it without kernel debugging tools. Review kernel logs for SCTP-related errors or crashes, or use kernel debuggers like ftrace or perf to monitor timer handler behavior in the SCTP module.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by triggering a kernel crash or memory corruption. It may also enable privilege escalation if the attacker can exploit the race condition to execute arbitrary code in the kernel context.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patching is not immediately possible, consider disabling the SCTP protocol module if not required. Monitor kernel logs for SCTP-related crashes or errors as potential indicators of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart