CVE-2026-98586

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: hold asoc or transport before mod_timer() in timer handlers

Take the association or transport reference before rearming a timer in the

timer handlers.

The existing code calls mod_timer() before taking the reference needed by

the rearmed timer without holding the sock lock. This creates a race with

timer cleanup: if the timer is deleted after mod_timer() returns but before

the reference is taken, the cleanup path can drop the timer's reference and

destroy the transport or association. The timer handler then takes a

reference on the already freed object and eventually drops it, causing a

refcount underflow.

Hold the object before mod_timer() and drop the reference if mod_timer()

reports that the timer was already pending in timer handlers. Apply the

same ordering to the proto-unreachable path, which can rearm a transport

timer outside the timer handlers without holding the sock lock.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References