---
id: "CVE-2026-98846"
kind: "vulnerability"
aliases: ["CVE-2026-98846"]
title: "Linux kernel: SCTP sendmsg can use a freed association after shutdown"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["kernel", "linux", "runtime", "sctp", "self-hosted"]
not_affected_if: ["sctp-module-not-loaded", "sctp-unused"]
published_at: "2026-10-18T16:17:38+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:13:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98846", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel: SCTP sendmsg can use a freed association after shutdown

A race in the Linux kernel's SCTP sendmsg path lets a concurrent ABORT and shutdown(SHUT_RD) free an association while sendmsg still uses it. The sources do not state the attacker's full capability beyond a use-after-free in the kernel.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel builds listed in the NVD entry
- `lsmod | grep sctp` to see whether the SCTP module is loaded at all
- unknown whether the sources name a specific affected kernel range

## Fix

- Install the kernel build from your distribution that includes the upstream fix for CVE-2026-98846 (the check of RCV_SHUTDOWN in sctp_sendmsg_to_asoc)
- Reboot into the patched kernel
- Optionally block the SCTP module if unused: `echo 'install sctp /bin/false' > /etc/modprobe.d/sctp.conf`

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98846

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

sctp: check RCV_SHUTDOWN after the sendmsg connect wait

sctp_wait_for_connect() drops the socket lock while it sleeps. An
out-of-the-blue ABORT can then be processed from the socket backlog and
unlink the association. If a concurrent shutdown(fd, SHUT_RD) sets
RCV_SHUTDOWN, the waiter breaks with err == 0 before checking
asoc->base.dead. Its final sctp_association_put() can then free the
association, leaving sctp_sendmsg_to_asoc() to continue with a dangling
pointer.

Check RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc()
before using the association again. The check only accesses the socket,
so it needs no additional association reference. Return the existing
-ESRCH so that sctp_sendmsg() skips freeing a new association that may
already have been destroyed.

Keep sctp_wait_for_connect() unchanged to preserve its behavior for the
connect() caller.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_