{"id":"CVE-2026-98846","kind":"vulnerability","aliases":["CVE-2026-98846"],"related":[],"title":"Linux kernel: SCTP sendmsg can use a freed association after shutdown","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: check RCV_SHUTDOWN after the sendmsg connect wait\n\nsctp_wait_for_connect() drops the socket lock while it sleeps. An\nout-of-the-blue ABORT can then be processed from the socket backlog and\nunlink the association. If a concurrent shutdown(fd, SHUT_RD) sets\nRCV_SHUTDOWN, the waiter breaks with err == 0 before checking\nasoc->base.dead. Its final sctp_association_put() can then free the\nassociation, leaving sctp_sendmsg_to_asoc() to continue with a dangling\npointer.\n\nCheck RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc()\nbefore using the association again. The check only accesses the socket,\nso it needs no additional association reference. Return the existing\n-ESRCH so that sctp_sendmsg() skips freeing a new association that may\nalready have been destroyed.\n\nKeep sctp_wait_for_connect() unchanged to preserve its behavior for the\nconnect() caller.","summary":"A race in the Linux kernel's SCTP sendmsg path lets a concurrent ABORT and shutdown(SHUT_RD) free an association while sendmsg still uses it. The sources do not state the attacker's full capability beyond a use-after-free in the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","runtime","sctp","self-hosted"],"not_affected_if":["sctp-module-not-loaded","sctp-unused"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the NVD entry\n- `lsmod | grep sctp` to see whether the SCTP module is loaded at all\n- unknown whether the sources name a specific affected kernel range","fix":"- Install the kernel build from your distribution that includes the upstream fix for CVE-2026-98846 (the check of RCV_SHUTDOWN in sctp_sendmsg_to_asoc)\n- Reboot into the patched kernel\n- Optionally block the SCTP module if unused: `echo 'install sctp /bin/false' > /etc/modprobe.d/sctp.conf`","status":"open","published_at":"2026-10-18T16:17:38+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:09+00:00","updated_at":"2026-10-25T05:13:09+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:13:09Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel build from your distribution that includes the upstream fix for CVE-2026-98846 (the check of RCV_SHUTDOWN in sctp_sendmsg_to_asoc)\n- Reboot into the patched kernel\n- Optionally block the SCTP module if unused: `echo 'install sctp /bin/false' > /etc/modprobe.d/sctp.conf`","reach":"unknown","title":"Linux kernel: SCTP sendmsg can use a freed association after shutdown","impact":"high","summary":"A race in the Linux kernel's SCTP sendmsg path lets a concurrent ABORT and shutdown(SHUT_RD) free an association while sendmsg still uses it. The sources do not state the attacker's full capability beyond a use-after-free in the kernel.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","sctp","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory use-after-free, possibly code execution or crash","analyst_note":"Find the NVD entry and the upstream kernel commit to confirm affected version ranges, the fixed stable builds, and whether an unprivileged local user can trigger the race.","how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the NVD entry\n- `lsmod | grep sctp` to see whether the SCTP module is loaded at all\n- unknown whether the sources name a specific affected kernel range","needs_analyst":true,"not_affected_if":["sctp-unused","sctp-module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with SCTP support that the fix covers; the race needs concurrent socket use of SCTP connections. Hosts that do not use SCTP can skip it, though the sources do not say whether SCTP must be loaded or reachable for exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000705,"input_tokens":3592,"output_tokens":691,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98846':14A,17A '0':134C 'abort':38B,106C 'access':181C 'addit':188C 'along':163C 'alreadi':206C 'asoc':137C,153C,172C 'associ':9A,45B,118C,142C,148C,176C,189C,203C 'attack':57B 'backlog':114C 'base.dead':138C 'behavior':219C 'beyond':61B 'blue':105C 'break':131C 'caller':223C 'capabl':60B 'check':81C,136C,160C,179C 'concurr':37B,121C 'connect':87C,92C,214C,222C 'continu':155C 'cve':12A,15A 'dangl':158C 'destroy':209C 'drop':93C 'err':133C 'error':167C 'esrch':194C 'exist':193C 'fd':123C 'final':140C 'follow':75C 'free':43B,66B,146C,200C 'freed':8A 'full':59B 'host':24B 'keep':210C 'kernel':2A,18B,30B,69B,73C 'leav':149C 'let':35B 'linux':1A,19B,29B,72C 'lock':96C 'may':205C 'need':186C 'new':202C 'out-of-the-blu':101C 'path':34B 'pointer':159C 'preserv':217C 'process':110C 'put':143C 'race':26B 'rcv':82C,127C,161C 'rd':42B,125C 'refer':190C 'resolv':79C 'return':191C 'runtim':20B 'sctp':3A,21B,32B,80C,89C,141C,150C,169C,197C,211C 'self':23B 'self-host':22B 'sendmsg':4A,33B,47B,86C,151C,170C,198C 'set':126C 'shut':41B,124C 'shutdown':11A,40B,83C,122C,128C,162C 'skip':199C 'sleep':99C 'socket':95C,113C,183C 'sourc':52B 'state':55B 'still':48B 'unchang':215C 'unlink':116C 'use':6A,49B,64B,174C 'use-after-fre':63B 'vulner':76C 'wait':88C,90C,166C,212C 'waiter':130C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with SCTP support that the fix covers; the race needs concurrent socket use of SCTP connections. Hosts that do not use SCTP can skip it, though the sources do not say whether SCTP must be loaded or reachable for exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98846","severity":null,"published_at":"2026-10-18T16:17:38+00:00","modified_at":"2026-10-21T13:21:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}