In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association… (CVE-2026-98548)

The vulnerability in the Linux kernel SCTP subsystem arises when an association in COOKIE-ECHOED state receives a bundled ERROR(Stale Cookie) and DATA packet from a non-primary address. Processing the ERROR chunk triggers removal of all non-primary transports, including the one the packet arrived on, but subsequent processing of the DATA chunk re-registers a reference to the now-freed transport. This leads to a use-after-free condition when later SCTP operations dereference the dangling pointer, causing potential kernel memory corruption. The issue is exploitable by any malicious SCTP peer or local unprivileged user without requiring special privileges. The fix discards the remainder of the packet after the stale-cookie error to avoid referencing freed transport objects.

Exploitation of this vulnerability can cause use-after-free memory corruption in the Linux kernel SCTP implementation. This may lead to kernel crashes or potentially arbitrary code execution in kernel context. The vulnerability is exploitable by any malicious SCTP peer or local unprivileged user without requiring elevated privileges.

A fix for this vulnerability has been implemented in the Linux kernel by discarding the rest of the packet upon detecting a stale-cookie error during SCTP processing. Users should apply the updated kernel version containing this patch to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.