CVE-2026-98130

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. A race condition exists when starting an SCTP timer, where the timer can expire before it is reset, resulting in improper reference counting for the connection association. An attacker could exploit this timing flaw during connection teardown to trigger a use-after-free condition, potentially causing a Denial of Service (DoS) or system crash.

This vulnerability is rated as Moderate severity because exploitation requires winning a tight time-of-check to time-of-use race condition during connection teardown, making reliable exploitation difficult. In Red Hat Enterprise Linux, the SCTP kernel module is not loaded by default and must be explicitly requested or configured by network applications. Consequently, systems that do not run SCTP-dependent services remain unexposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.