CVE-2026-98548

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: discard the rest of the packet on a stale-cookie error

When an association is in COOKIE-ECHOED state and the peer sends a

bundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary

addresses, processing the ERROR chunk takes the non-fatal stale-cookie

retry path sctp_sf_do_5_2_6_stale(), which queues

SCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.

sctp_cmd_del_non_primary() removes every non-primary transport -

including the very transport this packet arrived on, which is still

referenced by the receive lookup and shared by all chunks of the

packet via chunk->transport.

sctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from

the removed transport, but right afterwards the bundled DATA chunk

makes sctp_assoc_bh_rcv() re-register

asoc->peer.last_data_from = chunk->transport unconditionally, undoing

the redirection with the just-removed transport.

Once the packet is done,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References