CVE-2026-98548 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, SCTP service administrators, and security teams responsible for Linux kernel security should assess exposure and apply patches or mitigations as needed.

Why it matters

The Linux kernel's SCTP implementation is vulnerable to a use-after-free attack, which could lead to system crashes, code execution, or denial of service. Linux kernel developers, SCTP service administrators, and security teams should assess exposure and apply patches or mitigations as needed.

• Potential system crash or code execution
• Elevation of privileges or denial of service
• Data tampering or unauthorized access
• Compromised SCTP services or availability

Technical summary

The Linux kernel's SCTP implementation is vulnerable to a use-after-free attack. When an association is in COOKIE-ECHOED state and the peer sends a bundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary addresses, processing the ERROR chunk takes the non-fatal stale-cookie retry path. This path queues SCTP_CMD_DEL_NON_PRIMARY while keeping the association alive. However, the transport structure is removed while still referenced by the packet's chunks, leading to a potential crash or code execution.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to address the vulnerability
• Restrict access to SCTP services to trusted peers
• Monitor kernel logs for signs of exploitation
• Conduct a thorough review of network configurations and SCTP service exposure
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was introduced in the Linux kernel's SCTP implementation. A malicious SCTP peer or a local unprivileged user can trigger the use-after-free vulnerability. The CVE record and associated sources provide details on the vulnerability and potential mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.