---
id: "CVE-2026-99128"
kind: "vulnerability"
aliases: ["CVE-2026-99128"]
title: "Linux kernel SCTP: zero-length chunk lock-up lets a remote peer hang the host"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kernel", "linux", "sctp", "self-hosted", "telecom"]
not_affected_if: ["no-untrusted-network-access", "sctp-disabled"]
published_at: "2026-10-28T11:17:32+00:00"
first_seen_at: "2026-10-28T11:32:35+00:00"
updated_at: "2026-10-28T11:36:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99128", "first_seen_at": "2026-10-28T11:32:35+00:00"}]
---

# Linux kernel SCTP: zero-length chunk lock-up lets a remote peer hang the host

A malformed SCTP chunk with a declared length shorter than the four-byte header makes the kernel's inqueue parser return the same chunk repeatedly when SCTP AUTH covers ASCONF, locking up the receive softirq. A remote SCTP peer that has established an association can trigger it without credentials, causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the kernel is built with `CONFIG_IP_SCTP` and inspect `net.sctp.addip_enable` and `net.sctp.auth_enable` with `sysctl net.sctp.addip_enable net.sctp.auth_enable`
- Compare the running kernel with the fixed version listed by your distribution's advisory using `uname -r`
- unknown for exact affected kernel version ranges

## Fix

- Update the Linux kernel to a release containing the sctp inqueue chunk length fix (version unknown from these sources)
- If SCTP is not needed, unload or blacklist the sctp module
- unknown for a sysctl-only mitigation

## Timeline

- 2026-10-28T11:32:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99128

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate chunk length in the inqueue parser

SCTP chunks always include a four-byte generic header, but
sctp_inq_pop() currently accepts shorter declared lengths. A zero-length
chunk leaves chunk_end at the current header.

When ASCONF is covered by the association's SCTP-AUTH policy,
sctp_assoc_bh_rcv() can continue before the state machine performs its
normal chunk-length check. sctp_inq_pop() then returns the same malformed
chunk repeatedly and the receive softirq can lock up.

A remote SCTP peer can trigger this after establishing an association on
a kernel built with CONFIG_IP_SCTP and configured with
net.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did
not require application credentials, a shared SCTP AUTH key, or
net.sctp.addip_noauth_enable=1.

On commit f967455fb2a5 ("seg6: reset IP6CB after IPv6 decapsulation"),
one zero-length ASCONF caused repeated
watchdog soft-lockup reports in a two-vCPU KVM guest. All 3 pre-trigger
health probes succeeded, while 36 of 37 post-trigger probes failed. With
this change, all 37 post-trigger probes succeeded and no equivalent
soft-lockup signature appeared.

Reject chunks shorter than the generic SCTP header at the shared inqueue
parser boundary. Mark the packet for discard before either caller can
continue processing it, while preserving the four-byte generic minimum.
Declared-length 1 through 4 controls and kernel-generated ASCONF traffic
remained healthy. The patched sctp_hello selftest passed for IPv4 and
IPv6.

The complete private reproducer and validation evidence are available
directly to maintainers on request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_