CVE-2026-98614
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.18 %mayor que el 7 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
sctp: evitar livelock al actualizar la ruta de retransmisión
sctp_assoc_update_retran_path() puede entrar en un bucle infinito cuando todos los transportes restantes, incluido retran_path, están en estado SCTP_UNCONFIRMED: la comprobación de estado se ejecuta antes que la prueba de desbordamiento (wraparound), por lo que el bucle no puede detectar que ha completado una pasada completa.
Para corregirlo, se tiene en cuenta un transporte solo cuando no está en estado UNCONFIRMED y, a continuación, se comprueba si el recorrido ha vuelto a retran_path. Así, la terminación tras una pasada completa es independiente del estado del transporte, a la vez que se conserva la semántica de selección de reserva existente.
Leer descripción completaMostrar menos
Además, se restaura la protección contra NULL alrededor de la asignación de retran_path. En el caso en que todos los transportes están en UNCONFIRMED no existe ningún transporte sustituto elegible, y asignar NULL dejaría a los usos posteriores de la ruta de retransmisión y a la impresión de depuración con una ruta NULL.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.18 %
- Percentil entre todas las CVEs puntuadas
- 7
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/173610fff55022a5ad1579fbcc7faa97467b58b7
- https://git.kernel.org/stable/c/3fe624c3843694ab096fdb198526ba0c659febbe
- https://git.kernel.org/stable/c/43410c1f2db53516e95ddd7e5b4b02f495b78121
- https://git.kernel.org/stable/c/83b1a7f9e718828ef364a7b004254ebb2d0035fe
- https://git.kernel.org/stable/c/c9338057df1025f578fe7d0ff08bada87b8b838d
- https://git.kernel.org/stable/c/d2c31b837406395e576afeb25958c98e9938f3f6
- https://git.kernel.org/stable/c/d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49
- https://git.kernel.org/stable/c/ddc34cc0834c873871e88b055ee6a260676efe97
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98614",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0",
"lessThan": "3fe624c3843694ab096fdb198526ba0c659febbe",
"versionType": "git"
},
{
"status": "affected",
"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0",
"lessThan": "43410c1f2db53516e95ddd7e5b4b02f495b78121",
"versionType": "git"
},
{
"status": "affected",
"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0",
"lessThan": "d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49",
"versionType": "git"
},
{
"status": "affected",
"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0",
"lessThan": "83b1a7f9e718828ef364a7b004254ebb2d0035fe",
"versionType": "git"
},
{
"status": "affected",
"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0",
"lessThan": "173610fff55022a5ad1579fbcc7faa97467b58b7",
"versionType": "git"
},
{
"status": "affected",
"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0",
"lessThan": "c9338057df1025f578fe7d0ff08bada87b8b838d",
"versionType": "git"
},
{
"status": "affected",
"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0",
"lessThan": "ddc34cc0834c873871e88b055ee6a260676efe97",
"versionType": "git"
},
{
"status": "affected",
"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0",
"lessThan": "d2c31b837406395e576afeb25958c98e9938f3f6",
"versionType": "git"
},
{
"status": "affected",
"version": "8ceaec02b17397d12719a282945abc95f8149d9f",
"versionType": "git"
},
{
"status": "affected",
"version": "d2c2bdcdd8c5ce3d2a68aa3353ed1f340c3e500e",
"versionType": "git"
},
{
"status": "affected",
"version": "3.10.106",
"lessThan": "3.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "3.12.71",
"lessThan": "3.13",
"versionType": "semver"
}
],
"programFiles": [
"net/sctp/associola.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sctp/associola.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:14.267",
"references": [
{
"url": "https://git.kernel.org/stable/c/173610fff55022a5ad1579fbcc7faa97467b58b7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3fe624c3843694ab096fdb198526ba0c659febbe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/43410c1f2db53516e95ddd7e5b4b02f495b78121",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/83b1a7f9e718828ef364a7b004254ebb2d0035fe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c9338057df1025f578fe7d0ff08bada87b8b838d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d2c31b837406395e576afeb25958c98e9938f3f6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ddc34cc0834c873871e88b055ee6a260676efe97",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid livelock while updating retransmit path\n\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNCONFIRMED: the state check\nruns before the wraparound test, so the loop cannot observe that it has\ncompleted a full pass.\n\nFix this by considering a transport only when it is not UNCONFIRMED,\nthen checking whether the walk has returned to retran_path. This makes\nthe full-pass termination independent of the transport state while\npreserving the existing fallback selection semantics.\n\nAlso restore the NULL guard around the retran_path assignment. In the\nall-UNCONFIRMED case there is no eligible replacement transport, and\ninstalling NULL would leave later retransmit-path users and the debug\nprint with a NULL path."
}
],
"lastModified": "2026-10-19T10:19:25.303",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}