CVE-2026-98548

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker or an unprivileged local user could trigger a Denial of Service (DoS) or memory corruption by sending specially crafted packets containing bundled error and data chunks. This issue causes a use-after-free condition when a network transport structure is removed while remaining chunks in the same packet continue to reference it.

This vulnerability is rated as an Important severity because an unauthenticated remote peer or local unprivileged attacker can trigger a kernel crash or memory corruption without requiring special privileges. In typical Red Hat Enterprise Linux deployments, the sctp kernel module is not loaded by default unless an application explicitly creates an SCTP socket. Consequently, systems that do not run SCTP-based applications or services are not directly exposed to network exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to discard remaining bundled chunks in incoming SCTP packets immediately upon handling a stale-cookie error to prevent dereferencing deleted transport structures: upgrade to the fixed Kernel/Kernel Rt/Kernel Ivos Qualcomm/Openshift/Ose Rhel Coreos/Kpatch builds, which queue SCTP_CMD_DISCARD_PACKET in sctp_sf_do_5_2_6_stale() to discard the remaining chunks of the packet, closing bundled SCTP stale-cookie ERROR and DATA packet sent from a non-primary address. Until patched, this is only a concern on Linux hosts running the kernel SCTP stack with associations in COOKIE-ECHOED state exposed to remote network traffic or local users — Non-Linux platforms and systems where the kernel SCTP module is disabled or unreachable are unaffected — so Restrict ingress network access to listening SCTP endpoints using packet filtering, blacklist the sctp kernel module where SCTP transport is unneeded, and restrict unprivileged local users from opening network sockets. As a compensating measure, Enable runtime memory error detection such as KASAN to detect and trap use-after-free dereferences of the freed sctp_transport structure and Enable kernel slab freelist randomization and integrity hardening to mitigate control of freed kmalloc-1k slab objects. These controls limit blast radius and contain exploitation, but they do not fix the underlying SCTP transport use-after-free defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1005 Runtime Memory Error Detection (KASAN/HWASan) (medium)