All vulnerabilities
CVE-2026-98586

Linux: sctp: hold asoc or transport before mod_timer() in timer handlers

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9d3d39da054476e7aa05cd877b93ca73a9a77434Also 27c51a9b55b227309161c903f9ecfbf022516bc2, 35bf3b23c9a871f44c1453d85f8332be4e088ddaCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 9d3d39da054476e7aa05cd877b93ca73a9a77434LinuxCVE List
  • 27c51a9b55b227309161c903f9ecfbf022516bc2LinuxCVE List
  • 35bf3b23c9a871f44c1453d85f8332be4e088ddaLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: hold asoc or transport before mod_timer() in timer handlers

Take the association or transport reference before rearming a timer in the timer handlers.

The existing code calls mod_timer() before taking the reference needed by the rearmed timer without holding the sock lock. This creates a race with timer cleanup: if the timer is deleted after mod_timer() returns but before the reference is taken, the cleanup path can drop the timer's reference and destroy the transport or association. The timer handler then takes a reference on the already freed object and eventually drops it, causing a refcount underflow.

Hold the object before mod_timer() and drop the reference if mod_timer() reports that the timer was already pending in timer handlers. Apply the same ordering to the proto-unreachable path, which can rearm a transport timer outside the timer handlers without holding the sock lock.

Text from CVE List

Affected versions 16

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f7dea7eaea20fe9b80f8f77ba44d02b4a17f8050CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f9d929026d487a988bfa12c065f892e823e5b6abCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9d3d39da054476e7aa05cd877b93ca73a9a77434CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 27c51a9b55b227309161c903f9ecfbf022516bc2CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d18cb8fd1b6ba95c85de644203cfe1b071ff0c0fCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 35bf3b23c9a871f44c1453d85f8332be4e088ddaCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before cae23ae3f7887a1cf8a75da38edcebeef695040fCVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7