TOCTOU Race Condition in Linux Kernel Affecting SCTP Functionality

CVE-2026-98130

What is CVE-2026-98130?

A race condition exists in the SCTP_CMD_TIMER_START handler of the Linux kernel, where the timer state can change after checking if it is pending, leading to potential use-after-free errors. The vulnerability arises when timer_reduce() is called without ensuring the timer was successfully armed, which can create inconsistencies in the association reference count during teardown. This issue has been addressed in recent kernel updates.

References