CVE-2026-98548High· 7.5▾ TwilightA flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker or an unprivileged local user could trigger a Denial of Service (DoS) or memory corruption by sending specially crafted pa…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
— → 7.5
none → high
Last analysed / modified upstream
7.5 → 9.8
high → critical
0.2% → 0.7%
9.8 → 7.5
critical → high
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker or an unprivileged local user could trigger a Denial of Service (DoS) or memory corruption by sending specially crafted packets containing bundled error and data chunks. This issue causes a use-after-free condition when a network transport structure is removed while remaining chunks in the same packet continue to reference it.
kernel: sctp: discard the rest of the packet on a stale-cookie error — rated Important by Red Hat. Released 2026-10-18, updated 2026-10-24.
Affected:
No fix planned:
Affected
Workarounds / mitigations:
The highest-value action is to discard remaining bundled chunks in incoming SCTP packets immediately upon handlin…
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74264Medium· 4.7kernel: net: watchdog: fix refcount tracking races (CVE-2026-74264)
CVE-2026-109729Medium· 5.4Use-after-free in the JavaScript Engine: JIT component
CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …
CVE-2026-53384High· 7.0In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails dw8250_probe() registers the 8250 port via serial8250_register_8250_port() and then, if the devi…
CVE-2026-80764Medium· 4.7kernel: Bluetooth: hci_event: fix LE list UAF on reset (CVE-2026-80764)
CVE-2026-64554High· 7.0kernel: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (CVE-2026-64554)