Denial of Service Vulnerability in Linux Kernel's SCTP Module

CVE-2026-98123

What is CVE-2026-98123?

The Linux kernel's SCTP module contains a vulnerability that can be exploited to achieve a remote denial of service. An attacker can send a specially crafted ASCONF-ACK message that leads to a desynchronization in the way SCTP parameters are processed. This desynchronization can result in a soft lockup where the consumer spins in an infinite loop without making progress, effectively causing the system to hang. Additionally, a flaw allows the processing of SCTP_PARAM_ERR_CAUSE parameters without adequate length checks, potentially leading to out-of-bounds reads. It is crucial to ensure proper padding and verification in order to maintain system integrity and prevent exploitation.

References