Live › vulnerability › CVE-2026-98614
Go to dashboardIn the Linux kernel's SCTP stack, the function that picks a new retransmit path can loop forever when every remaining transport is unconfirmed. The fix makes that loop terminate and keeps a NULL path from being installed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with SCTP support and multihomed SCTP associations are the ones that could hit this path. The sources do not say which configurations trigger the livelock, and they do not describe a remote trigger. Hosts that do not use SCTP can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
sctp: avoid livelock while updating retransmit path
sctp_assoc_update_retran_path() can loop forever when every remaining transport, including retran_path, is SCTP_UNCONFIRMED: the state check runs before the wraparound test, so the loop cannot observe that it has completed a full pass.
Fix this by considering a transport only when it is not UNCONFIRMED, then checking whether the walk has returned to retran_path. This makes the full-pass termination independent of the transport state while preserving the existing fallback selection semantics.
Also restore the NULL guard around the retran_path assignment. In the all-UNCONFIRMED case there is no eligible replacement transport, and installing NULL would leave later retransmit-path users and the debug print with a NULL path.
This page as .md · .json · in your agent: get_signal("CVE-2026-98614")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.