{"id":"CVE-2026-98614","kind":"vulnerability","aliases":["CVE-2026-98614"],"related":[],"title":"Linux kernel SCTP: retransmit path update can livelock the kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid livelock while updating retransmit path\n\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNCONFIRMED: the state check\nruns before the wraparound test, so the loop cannot observe that it has\ncompleted a full pass.\n\nFix this by considering a transport only when it is not UNCONFIRMED,\nthen checking whether the walk has returned to retran_path. This makes\nthe full-pass termination independent of the transport state while\npreserving the existing fallback selection semantics.\n\nAlso restore the NULL guard around the retran_path assignment. In the\nall-UNCONFIRMED case there is no eligible replacement transport, and\ninstalling NULL would leave later retransmit-path users and the debug\nprint with a NULL path.","summary":"In the Linux kernel's SCTP stack, the function that picks a new retransmit path can loop forever when every remaining transport is unconfirmed. The fix makes that loop terminate and keeps a NULL path from being installed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","sctp","self-hosted"],"not_affected_if":["no-sctp-use"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit fixing sctp_assoc_update_retran_path(); the sources do not name a version.","status":"open","published_at":"2026-10-18T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:21+00:00","updated_at":"2026-10-25T05:21:21+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:21:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit fixing sctp_assoc_update_retran_path(); the sources do not name a version.","reach":"unknown","title":"Linux kernel SCTP: retransmit path update can livelock the kernel","impact":"medium","summary":"In the Linux kernel's SCTP stack, the function that picks a new retransmit path can loop forever when every remaining transport is unconfirmed. The fix makes that loop terminate and keeps a NULL path from being installed.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","sctp","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; a kernel livelock causing denial of service","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected and fixed kernel versions and whether a remote trigger exists.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-sctp-use"],"who_is_affected":"Systems running a Linux kernel with SCTP support and multihomed SCTP associations are the ones that could hit this path. The sources do not say which configurations trigger the livelock, and they do not describe a remote trigger. Hosts that do not use SCTP can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000593,"input_tokens":3497,"output_tokens":487,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98614':13A,16A 'all-unconfirm':171C 'also':159C 'around':164C 'assign':168C 'assoc':81C 'avoid':74C 'cannot':109C 'case':174C 'check':100C,131C 'complet':114C 'consid':121C 'cve':11A,14A 'debug':193C 'elig':178C 'everi':44B,89C 'exist':155C 'fallback':156C 'fix':50B,118C 'follow':68C 'forev':42B,87C 'full':116C,144C 'full-pass':143C 'function':33B 'guard':163C 'host':24B 'includ':92C 'independ':147C 'instal':62B,182C 'keep':56B 'kernel':2A,10A,19B,28B,66C 'later':186C 'leav':185C 'linux':1A,18B,27B,65C 'linux-kernel':17B 'livelock':8A,75C 'loop':41B,53B,86C,108C 'make':51B,141C 'new':37B 'null':58B,162C,183C,197C 'observ':110C 'pass':117C,145C 'path':5A,39B,59B,79C,84C,94C,139C,167C,189C,198C 'pick':35B 'preserv':153C 'print':194C 'remain':45B,90C 'replac':179C 'resolv':72C 'restor':160C 'retran':83C,93C,138C,166C 'retransmit':4A,38B,78C,188C 'retransmit-path':187C 'return':136C 'run':101C 'runtim':20B 'sctp':3A,21B,30B,73C,80C,96C 'select':157C 'self':23B 'self-host':22B 'semant':158C 'stack':31B 'state':99C,151C 'termin':54B,146C 'test':105C 'transport':46B,91C,123C,150C,180C 'unconfirm':48B,97C,129C,173C 'updat':6A,77C,82C 'user':190C 'vulner':69C 'walk':134C 'whether':132C 'would':184C 'wraparound':104C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with SCTP support and multihomed SCTP associations are the ones that could hit this path. The sources do not say which configurations trigger the livelock, and they do not describe a remote trigger. Hosts that do not use SCTP can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98614","severity":null,"published_at":"2026-10-18T16:17:14+00:00","modified_at":"2026-10-19T10:19:25+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}