In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before mod_timer() in timer handlers Take the… (CVE-2026-98586)

The vulnerability in the Linux kernel SCTP subsystem was due to improper reference handling in timer handlers. The existing code called mod_timer() before acquiring the necessary reference on the association or transport object without holding the socket lock. This created a race condition where the timer could be deleted after mod_timer() returns but before the reference is taken, leading to the timer handler referencing an already freed object and causing a reference count underflow. The fix involved holding the object reference before calling mod_timer() and dropping it if mod_timer() indicates the timer was already pending. The same fix was applied to the proto-unreachable path that rearms transport timers outside timer handlers without holding the socket lock.

This vulnerability could cause a reference count underflow in the kernel, potentially leading to use-after-free conditions and kernel memory corruption. Such issues may result in system instability or crashes. No known exploits in the wild have been reported.

A fix has been applied to the Linux kernel to correct the order of operations in SCTP timer handlers. Users should update to the fixed kernel version once available from their distribution or vendor. Since this is a kernel-level issue, applying the official patch or upgrading the kernel is the recommended remediation.