CVE-2026-98846: Linux Kernel SCTP Use-After-Free Vulnerability

CVE-2026-98846 Overview

CVE-2026-98846 is a use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw lives in sctp_wait_for_connect() and the surrounding sctp_sendmsg_to_asoc() path. The waiter drops the socket lock while sleeping, allowing an out-of-the-blue ABORT chunk processed from the backlog to unlink the association. A concurrent shutdown(fd, SHUT_RD) can set RCV_SHUTDOWN and wake the sleeper with err == 0, bypassing the asoc->base.dead check. The final sctp_association_put() can then free the association while sctp_sendmsg_to_asoc() continues operating on a dangling pointer.

Critical Impact
Local attackers with a connected SCTP socket can trigger a kernel use-after-free, enabling potential denial of service or memory corruption in kernel space.

Affected Products

Linux kernel SCTP subsystem (net/sctp/socket.c)
Stable kernel branches referenced in the upstream fix commits
Distributions shipping unpatched kernels with SCTP enabled

Discovery Timeline

2026-10-18 - CVE-2026-98846 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98846

Vulnerability Analysis

The defect is a race between the SCTP sendmsg connect path and asynchronous socket state changes. sctp_wait_for_connect() releases the socket lock before sleeping on the connect wait queue. During this window, the kernel backlog can process an out-of-the-blue ABORT chunk that unlinks the association from the socket. If another thread calls shutdown(fd, SHUT_RD), the RCV_SHUTDOWN flag is set and the waiter is woken with a return value of zero.

Because the wait returns success, the dead-association check on asoc->base.dead is skipped. The final reference release through sctp_association_put() then frees the association. Control returns to sctp_sendmsg_to_asoc(), which continues to dereference the freed association structure, producing a classic use-after-free [CWE-416].

Root Cause

The root cause is incomplete validation of socket state after sctp_wait_for_connect() returns. The waiter checks the wait error but does not re-examine RCV_SHUTDOWN relative to association liveness. The upstream fix adds an RCV_SHUTDOWN check alongside the wait error in sctp_sendmsg_to_asoc() and returns -ESRCH, instructing sctp_sendmsg() to skip freeing an association that may already have been destroyed.

Attack Vector

Exploitation requires a local process holding an SCTP socket and the ability to drive concurrent sendmsg(), shutdown(), and remote ABORT traffic. A peer or on-path attacker can send an out-of-the-blue ABORT while the local process issues shutdown(fd, SHUT_RD) during a pending sendmsg() connect. Winning the race frees the association structure and leaves sctp_sendmsg_to_asoc() operating on freed memory. See the kernel commits for the exact code change: Kernel Git Commit 1bef1944 and Kernel Git Commit e8f972b1.

Detection Methods for CVE-2026-98846

Indicators of Compromise

Kernel oops or panic entries referencing sctp_sendmsg_to_asoc, sctp_wait_for_connect, or sctp_association_put in dmesg and /var/log/kern.log.
KASAN use-after-free reports naming SCTP association objects on kernels built with memory sanitizers.
Unexpected process termination with SIGBUS or kernel-induced socket errors on hosts running SCTP workloads.

Detection Strategies

Hunt for unexpected loads of the sctp kernel module on hosts that do not require SCTP.
Correlate shutdown() syscalls on SCTP sockets with inbound SCTP ABORT chunks observed in packet capture.
Alert on kernel crash telemetry whose stack frames include SCTP symbols.

Monitoring Recommendations

Ingest kmsg and crash dumps into a central log pipeline for pattern matching across the fleet.
Track kernel version inventory and flag hosts running pre-patch builds with CONFIG_IP_SCTP=y.
Monitor process accounting for repeated short-lived processes invoking SCTP syscalls, which may indicate race-condition fuzzing.

How to Mitigate CVE-2026-98846

Immediate Actions Required

Apply the upstream SCTP fix to all affected stable kernel branches and reboot the host.
Unload the sctp module where the protocol is not required: modprobe -r sctp.
Blacklist SCTP via /etc/modprobe.d/ on systems that must not expose the stack.

Patch Information

The vulnerability is resolved by adding an RCV_SHUTDOWN check in sctp_sendmsg_to_asoc() and returning -ESRCH so the caller skips freeing a potentially destroyed association. The behavior of sctp_wait_for_connect() is intentionally preserved for the connect() caller. Apply vendor-provided kernel updates referencing the upstream commits: Kernel Git Commit 222c41e0, Kernel Git Commit 4f1da630, and Kernel Git Commit e701345d.

Workarounds

Disable SCTP module loading on hosts that do not require the protocol.
Restrict unprivileged user namespaces and limit which users can open SCTP sockets.
Filter inbound SCTP traffic at the host firewall to limit exposure to attacker-sent ABORT chunks.

bash

# Prevent the sctp module from loading on hosts that do not need it
echo 'install sctp /bin/true' | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo modprobe -r sctp 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep -i sctp