CVE-2026-98123 Linux CVE debrief

Who should care

Linux kernel administrators and developers, SCTP users and implementers, and security teams should be aware of this issue and take steps to patch their systems. Affected operators and platforms should review and update their SCTP configurations to ensure secure associations. Vulnerability management teams should prioritize patching and monitoring for potential SCTP-related issues.

Why it matters

CVE-2026-98123 is a remote denial of service vulnerability in the Linux kernel's SCTP implementation. It requires patching to prevent service disruption and has potential for soft lockup, indicating need for timely kernel updates and monitoring.

• Remote denial of service vulnerability requires patching to prevent service disruption
• Potential for soft lockup indicates need for timely kernel updates and monitoring

Technical summary

The Linux kernel's SCTP implementation is vulnerable to a remote denial of service attack due to its handling of unpadded ASCONF-ACK parameters. A remote peer can trigger a soft lockup with a crafted ASCONF-ACK on an ADD-IP enabled association. The vulnerability is caused by the SCTP implementation's handling of unpadded ASCONF-ACK parameters, which can lead to a soft lockup. This issue was found by ZeroHive, a vulnerability hunting agent at Tencent Yunding Lab, and resolved with kernel patches. The attack requires no authentication and can be performed by a remote peer.

Defensive priority

Apply kernel patches to address the SCTP ASCONF-ACK vulnerability

Recommended defensive actions

• Apply kernel patches to address the SCTP ASCONF-ACK vulnerability
• Review and update SCTP configurations to ensure secure associations
• Monitor kernel logs for signs of potential SCTP-related issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue is caused by the SCTP implementation's handling of unpadded ASCONF-ACK parameters, which can lead to a soft lockup. The vulnerability is a pure remote denial of service, and the attack can be triggered with a crafted ASCONF-ACK on an ADD-IP enabled association. The attack requires no authentication and can be performed by a remote peer. ZeroHive, a vulnerability hunting agent at Tencent Yunding Lab, found this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.