CVE-2026-98548
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
sctp: descartar el resto del paquete ante un error de cookie obsoleta
Cuando una asociación está en estado COOKIE-ECHOED y el par envía un paquete agrupado [ERROR(Stale Cookie)][DATA] desde una de sus direcciones no primarias, el procesamiento del fragmento ERROR sigue la ruta de reintento no fatal por cookie obsoleta sctp_sf_do_5_2_6_stale(), que encola SCTP_CMD_DEL_NON_PRIMARY manteniendo la asociación activa. sctp_cmd_del_non_primary() elimina todos los transportes no primarios, incluido el propio transporte por el que llegó este paquete, que sigue referenciado por la búsqueda de recepción y es compartido por todos los fragmentos del paquete mediante chunk->transport.
Leer descripción completaMostrar menos
sctp_assoc_rm_peer() sí redirige asoc->peer.last_data_from lejos del transporte eliminado, pero justo después el fragmento DATA agrupado hace que sctp_assoc_bh_rcv() vuelva a registrar asoc->peer.last_data_from = chunk->transport incondicionalmente, deshaciendo la redirección con el transporte recién eliminado.
Una vez terminado el paquete, se libera la referencia de recepción y el transporte se libera mediante RCU, mientras la asociación superviviente conserva el last_data_from colgante. Un FWD-TSN posterior (o el temporizador de SACK diferido) hace que sctp_gen_sack() lo desreferencie (->param_flags y similares), y sctp_make_sack()/sctp_outq_select_transport() pueden escribir en el objeto liberado y enlazarlo en la lista de transportes activa. Se trata de un use-after-free (uso de memoria liberada) que puede activar cualquier par SCTP malicioso (o un usuario local sin privilegios que actúe como tal) sin necesidad de capacidades:
Tenga en cuenta que el commit 03a9d10ecf71 ("sctp: drop a chunk if its transport was removed") solo cubre el intervalo entre la búsqueda de recepción y el procesamiento del fragmento (por ejemplo, un ASCONF DEL-IP que compite con la cola del socket); aquí el transporte se elimina *durante* el procesamiento del paquete, por un fragmento anterior del mismo paquete, de modo que el descarte en sctp_inq_push() no alcanza esta ruta. Verificado con el reproductor incluido [ERROR(Stale Cookie)][DATA] + FWD-TSN: el informe de KASAN anterior sigue apareciendo con ese commit aplicado, y desaparece con este parche encima.
La solución consiste en descartar el resto del paquete por esta ruta, tal como sugirió Xin. Después de que el error de cookie obsoleta devuelva la asociación a COOKIE-WAIT y elimine los transportes no primarios, los fragmentos restantes del paquete solo pueden ejecutarse contra el handshake reiniciado haciendo referencia al transporte de llegada eliminado mediante chunk->transport: además del registro de last_data_from indicado, sctp_cmd_setup_t2() y los constructores de respuestas sctp_make_*() también copiarían ese puntero en estado de vida de la asociación que sctp_assoc_rm_peer() ya ha saneado. Se deja que el par retransmita dichos fragmentos, en línea con lo que hace sctp_inq_push() con los fragmentos cuyo transporte se eliminó antes del procesamiento.
Detalles técnicos trazas, registros y código del informe original
BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660
Read of size 4 at addr ffff88800e1e356c by task poc/115
Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <-
sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv
Allocated: sctp_transport_new <- sctp_assoc_add_peer <-
sctp_process_init (procesamiento de INIT-ACK)
Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core
(call_rcu encolado por sctp_transport_put al final de sctp_rcv)
The buggy address is located 364 bytes inside of freed 1024-byte
region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1kTraducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2
- https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449
- https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4
- https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2
- https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665
- https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a
- https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321
- https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98548",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "854c053c71459f8db7ef07db9cfa4eec5f5206f2",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "965e21ea16acb394d5e5801998ca9b0adc669665",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "1cd246b214dc9acf4e2f11d58c035e1e672fe7d2",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "d68c9287b3ca0d6faadc61fbcb18d1a6b5493321",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "ec23855274a73906b02f0d124fefd9cb3c008b1d",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "6df536c5acbc0abd6f119d02e24f4a2ed97707f4",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "4498467a8af06cfa3d71cb04bd7c4170dec8f449",
"versionType": "git"
}
],
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:06.767",
"references": [
{
"url": "https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: discard the rest of the packet on a stale-cookie error\n\nWhen an association is in COOKIE-ECHOED state and the peer sends a\nbundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary\naddresses, processing the ERROR chunk takes the non-fatal stale-cookie\nretry path sctp_sf_do_5_2_6_stale(), which queues\nSCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.\nsctp_cmd_del_non_primary() removes every non-primary transport -\nincluding the very transport this packet arrived on, which is still\nreferenced by the receive lookup and shared by all chunks of the\npacket via chunk->transport.\n\nsctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from\nthe removed transport, but right afterwards the bundled DATA chunk\nmakes sctp_assoc_bh_rcv() re-register\nasoc->peer.last_data_from = chunk->transport unconditionally, undoing\nthe redirection with the just-removed transport.\n\nOnce the packet is done, the receive reference is dropped and the\ntransport is RCU-freed, while the surviving association keeps the\ndangling last_data_from. A later FWD-TSN (or the delayed SACK timer)\nmakes sctp_gen_sack() dereference it (->param_flags and friends), and\nsctp_make_sack()/sctp_outq_select_transport() may write to the freed\nobject and link it into the live transport list. This is a\nuse-after-free triggerable by any malicious SCTP peer (or a local\nunprivileged user acting as one) with no capabilities required:\n\n BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660\n Read of size 4 at addr ffff88800e1e356c by task poc/115\n Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <-\n sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv\n Allocated: sctp_transport_new <- sctp_assoc_add_peer <-\n sctp_process_init (INIT-ACK processing)\n Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core\n (call_rcu queued by sctp_transport_put at end of sctp_rcv)\n The buggy address is located 364 bytes inside of freed 1024-byte\n region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k\n\nNote that commit 03a9d10ecf71 (\"sctp: drop a chunk if its transport\nwas removed\") only covers the window between the receive lookup and\nthe chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog);\nhere the transport is removed *while* the packet is being processed,\nby an earlier chunk of the same packet, so the drop in sctp_inq_push()\ndoes not reach this path. Verified with the bundled [ERROR(Stale\nCookie)][DATA] + FWD-TSN reproducer: the KASAN report above still\nfires with that commit applied, and is gone with this patch on top.\n\nFix it by discarding the rest of the packet on this path, as suggested\nby Xin. After the stale-cookie ERROR has sent the association back to\nCOOKIE-WAIT and removed the non-primary transports, the remaining\nchunks of the packet can only run against the restarted handshake\nwhile referencing the removed arrival transport through\nchunk->transport: besides the last_data_from registration above,\nsctp_cmd_setup_t2() and the sctp_make_*() reply builders would also\ncopy that pointer into association-lifetime state that\nsctp_assoc_rm_peer() has already sanitized. Let the peer retransmit\nthem, in line with what sctp_inq_push() does for chunks whose\ntransport was removed before processing."
}
],
"lastModified": "2026-10-19T10:19:10.887",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}