CVE-2026-98123

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration

sctp_verify_asconf() walks ASCONF-ACK parameters with

sctp_walk_params(), which advances by SCTP_PAD4(length), while the

consumer sctp_get_asconf_response() iterates the same parameters

advancing by the raw length, without padding. A single odd-length

parameter desynchronises the two walks and makes the consumer

interpret attacker-controlled bytes at a misaligned offset.

When those bytes yield a length of zero, the while loop over

asconf_ack_len makes no progress, spinning forever in softirq

context, and the watchdog reports a soft lockup. All reads stay

within the received skb, so the lockup is a pure remote denial of

service. A remote peer can trigger it with a crafted ASCONF-ACK on

an ADD-IP enabled association with an outstanding ASCONF (RFC 5061

section 4.1.2 requires the chunk to be authenticated, but the

predefined empty key id 0 allows the pe

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References