kernel: sctp: hold asoc or transport before mod_timer() in timer handlers (CVE-2026-98586)

Overview

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. This vulnerability can lead to a Denial of Service (DoS) through a kernel crash. A race condition occurs between timer rearming and cleanup operations because the system modifies a timer before properly acquiring a reference to the associated transport object. An attacker able to generate SCTP traffic can trigger this timing window, causing a reference count underflow on an already freed memory object and resulting in system instability.

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-20 · vex

kernel: sctp: hold asoc or transport before mod_timer() in timer handlers — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.

Affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat OpenShift Container Platform 4

No fix planned:

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat OpenShift Container Platform 4

Remediation

Out of support scope