{"id":"CVE-2026-99128","kind":"vulnerability","aliases":["CVE-2026-99128"],"related":[],"title":"Linux kernel SCTP: zero-length chunk lock-up lets a remote peer hang the host","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate chunk length in the inqueue parser\n\nSCTP chunks always include a four-byte generic header, but\nsctp_inq_pop() currently accepts shorter declared lengths. A zero-length\nchunk leaves chunk_end at the current header.\n\nWhen ASCONF is covered by the association's SCTP-AUTH policy,\nsctp_assoc_bh_rcv() can continue before the state machine performs its\nnormal chunk-length check. sctp_inq_pop() then returns the same malformed\nchunk repeatedly and the receive softirq can lock up.\n\nA remote SCTP peer can trigger this after establishing an association on\na kernel built with CONFIG_IP_SCTP and configured with\nnet.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did\nnot require application credentials, a shared SCTP AUTH key, or\nnet.sctp.addip_noauth_enable=1.\n\nOn commit f967455fb2a5 (\"seg6: reset IP6CB after IPv6 decapsulation\"),\none zero-length ASCONF caused repeated\nwatchdog soft-lockup reports in a two-vCPU KVM guest. All 3 pre-trigger\nhealth probes succeeded, while 36 of 37 post-trigger probes failed. With\nthis change, all 37 post-trigger probes succeeded and no equivalent\nsoft-lockup signature appeared.\n\nReject chunks shorter than the generic SCTP header at the shared inqueue\nparser boundary. Mark the packet for discard before either caller can\ncontinue processing it, while preserving the four-byte generic minimum.\nDeclared-length 1 through 4 controls and kernel-generated ASCONF traffic\nremained healthy. The patched sctp_hello selftest passed for IPv4 and\nIPv6.\n\nThe complete private reproducer and validation evidence are available\ndirectly to maintainers on request.","summary":"A malformed SCTP chunk with a declared length shorter than the four-byte header makes the kernel's inqueue parser return the same chunk repeatedly when SCTP AUTH covers ASCONF, locking up the receive softirq. A remote SCTP peer that has established an association can trigger it without credentials, causing a denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","sctp","self-hosted","telecom"],"not_affected_if":["no-untrusted-network-access","sctp-disabled"],"how_to_check":"- Check whether the kernel is built with `CONFIG_IP_SCTP` and inspect `net.sctp.addip_enable` and `net.sctp.auth_enable` with `sysctl net.sctp.addip_enable net.sctp.auth_enable`\n- Compare the running kernel with the fixed version listed by your distribution's advisory using `uname -r`\n- unknown for exact affected kernel version ranges","fix":"- Update the Linux kernel to a release containing the sctp inqueue chunk length fix (version unknown from these sources)\n- If SCTP is not needed, unload or blacklist the sctp module\n- unknown for a sysctl-only mitigation","status":"open","published_at":"2026-10-28T11:17:32+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:19+00:00","updated_at":"2026-10-28T11:36:19+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T11:36:19Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release containing the sctp inqueue chunk length fix (version unknown from these sources)\n- If SCTP is not needed, unload or blacklist the sctp module\n- unknown for a sysctl-only mitigation","reach":"network","title":"Linux kernel SCTP: zero-length chunk lock-up lets a remote peer hang the host","impact":"medium","summary":"A malformed SCTP chunk with a declared length shorter than the four-byte header makes the kernel's inqueue parser return the same chunk repeatedly when SCTP AUTH covers ASCONF, locking up the receive softirq. A remote SCTP peer that has established an association can trigger it without credentials, causing a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","sctp","self-hosted","telecom"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote peer can hang the kernel receive softirq, causing denial of service","analyst_note":"Find the upstream fix commit and the affected kernel version ranges from the NVD entry or kernel.org stable releases.","how_to_check":"- Check whether the kernel is built with `CONFIG_IP_SCTP` and inspect `net.sctp.addip_enable` and `net.sctp.auth_enable` with `sysctl net.sctp.addip_enable net.sctp.auth_enable`\n- Compare the running kernel with the fixed version listed by your distribution's advisory using `uname -r`\n- unknown for exact affected kernel version ranges","needs_analyst":true,"not_affected_if":["sctp-disabled","no-untrusted-network-access"],"who_is_affected":"Systems running a Linux kernel built with SCTP support that accept SCTP associations from remote peers, especially with ASCONF and SCTP AUTH enabled via net.sctp.addip_enable=1 and net.sctp.auth_enable=1. Hosts without SCTP support or where SCTP is not reachable from untrusted networks are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":3864,"output_tokens":748,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,22A '-99128':20A,23A '1':206C,210C,227C,328C '3':257C '36':265C '37':267C,277C '4':330C 'accept':120C 'alway':107C 'appear':290C 'applic':216C 'asconf':62B,137C,241C,336C 'assoc':149C 'associ':76B,142C,192C 'auth':60B,146C,221C 'avail':358C 'bh':150C 'boundari':304C 'built':196C 'byte':45B,112C,322C 'caller':312C 'caus':82B,242C 'chang':275C 'check':164C 'chunk':7A,35B,56B,99C,106C,128C,130C,162C,173C,292C 'chunk-length':161C 'commit':229C 'complet':351C 'config':198C 'configur':202C 'continu':153C,314C 'control':331C 'cover':61B,139C 'credenti':81B,217C 'current':119C,134C 'cve':18A,21A 'decapsul':236C 'declar':38B,122C,326C 'declared-length':325C 'denial':84B 'direct':359C 'discard':309C 'either':311C 'enabl':205C,209C,226C 'end':131C 'equival':285C 'establish':74B,190C 'evid':356C 'f967455fb2a5':230C 'fail':272C 'follow':92C 'four':44B,111C,321C 'four-byt':43B,110C,320C 'generat':335C 'generic':113C,296C,323C 'guest':255C 'hang':15A 'header':46B,114C,135C,298C 'health':261C 'healthi':339C 'hello':343C 'host':17A,30B 'includ':108C 'infrastructur':24B 'inq':117C,166C 'inqueu':51B,103C,302C 'ip':199C 'ip6cb':233C 'ipv4':347C 'ipv6':235C,349C 'kernel':2A,25B,49B,90C,195C,334C 'kernel-gener':333C 'key':222C 'kvm':254C 'leav':129C 'length':6A,39B,100C,123C,127C,163C,240C,327C 'let':11A 'linux':1A,26B,89C 'lock':9A,63B,180C 'lock-up':8A 'lockup':247C,288C 'machin':157C 'maintain':361C 'make':47B 'malform':33B,172C 'mark':305C 'minimum':324C 'net.sctp.addip':204C,224C 'net.sctp.auth':208C 'noauth':225C 'normal':160C 'one':237C 'packet':307C 'parser':52B,104C,303C 'pass':345C 'patch':341C 'peer':14A,71B,185C 'perform':158C 'polici':147C 'pop':118C,167C 'post':269C,279C 'post-trigg':268C,278C 'pre':259C 'pre-trigg':258C 'preserv':318C 'privat':352C 'probe':262C,271C,281C 'process':315C 'rcv':151C 'receiv':66B,177C 'reject':291C 'remain':338C 'remot':13A,69B,183C 'repeat':57B,174C,243C 'report':248C 'reproduc':212C,353C 'request':363C 'requir':215C 'reset':232C 'resolv':96C 'return':53B,169C 'sctp':3A,27B,34B,59B,70B,97C,105C,116C,145C,148C,165C,184C,200C,220C,297C,342C 'sctp-auth':144C 'seg6':231C 'self':29B 'self-host':28B 'selftest':344C 'servic':86B 'share':219C,301C 'shorter':40B,121C,293C 'signatur':289C 'soft':246C,287C 'soft-lockup':245C,286C 'softirq':67B,178C 'state':156C 'succeed':263C,282C 'telecom':31B 'traffic':337C 'trigger':78B,187C,260C,270C,280C 'two':252C 'two-vcpu':251C 'valid':98C,355C 'vcpu':253C 'vulner':93C 'watchdog':244C 'without':80B 'zero':5A,126C,239C 'zero-length':4A,125C,238C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel built with SCTP support that accept SCTP associations from remote peers, especially with ASCONF and SCTP AUTH enabled via net.sctp.addip_enable=1 and net.sctp.auth_enable=1. Hosts without SCTP support or where SCTP is not reachable from untrusted networks are unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99128","severity":null,"published_at":"2026-10-28T11:17:32+00:00","modified_at":"2026-10-28T11:17:32+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}