CVE-2026-98548
Description
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker or an unprivileged local user could trigger a Denial of Service (DoS) or memory corruption by sending specially crafted packets containing bundled error and data chunks. This issue causes a use-after-free condition when a network transport structure is removed while remaining chunks in the same packet continue to reference it.
Statement
This vulnerability is rated as an Important severity because an unauthenticated remote peer or local unprivileged attacker can trigger a kernel crash or memory corruption without requiring special privileges. In typical Red Hat Enterprise Linux deployments, the sctp kernel module is not loaded by default unless an application explicitly creates an SCTP socket. Consequently, systems that do not run SCTP-based applications or services are not directly exposed to network exploitation.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to discard remaining bundled chunks in incoming SCTP packets immediately upon handling a stale-cookie error to prevent dereferencing deleted transport structures: upgrade to the fixed Kernel/Kernel Rt/Kernel Ivos Qualcomm/Openshift/Ose Rhel Coreos/Kpatch builds, which queue SCTP_CMD_DISCARD_PACKET in sctp_sf_do_5_2_6_stale() to discard the remaining chunks of the packet, closing bundled SCTP stale-cookie ERROR and DATA packet sent from a non-primary address. Until patched, this is only a concern on Linux hosts running the kernel SCTP stack with associations in COOKIE-ECHOED state exposed to remote network traffic or local users — Non-Linux platforms and systems where the kernel SCTP module is disabled or unreachable are unaffected — so Restrict ingress network access to listening SCTP endpoints using packet filtering, blacklist the sctp kernel module where SCTP transport is unneeded, and restrict unprivileged local users from opening network sockets. As a compensating measure, Enable runtime memory error detection such as KASAN to detect and trap use-after-free dereferences of the freed sctp_transport structure and Enable kernel slab freelist randomization and integrity hardening to mitigate control of freed kmalloc-1k slab objects. These controls limit blast radius and contain exploitation, but they do not fix the underlying SCTP transport use-after-free defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1005 Runtime Memory Error Detection (KASAN/HWASan) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
