CVE-2026-98123 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
sctp_verify_asconf() walks ASCONF-ACK parameters with sctp_walk_params(), which advances by SCTP_PAD4(length), while the consumer sctp_get_asconf_response() iterates the same parameters advancing by the raw length, without padding. A single odd-length parameter desynchronises the two walks and makes the consumer interpret attacker-controlled bytes at a misaligned offset.
When those bytes yield a length of zero, the while loop over asconf_ack_len makes no progress, spinning forever in softirq context, and the watchdog reports a soft lockup. All reads stay within the received skb, so the lockup is a pure remote denial of service. A remote peer can trigger it with a crafted ASCONF-ACK on an ADD-IP enabled association with an outstanding ASCONF (RFC 5061 section 4.1.2 requires the chunk to be authenticated, but the predefined empty key id 0 allows the peer to compute the same association HMAC from publicly exchanged parameters, so the gate does not help).
The SCTP_PARAM_ERR_CAUSE case of sctp_verify_asconf() also performs no length check, letting a parameter without a complete error header reach the consumer, which reads errhdr.cause past the end of the parameter, an out-of-bounds read.
Reject SCTP_PARAM_ERR_CAUSE parameters shorter than sizeof(struct sctp_addip_param) + sizeof(struct sctp_errhdr) at the verifier, and advance the consumer iterator with the same padding rule as the verifier to keep the two walks in lockstep. The verifier change guarantees a complete error header in every ERR_CAUSE parameter the consumer can see, so the consumer's asconf_ack_len check is dropped and it returns err_param->cause directly. The consumer padding fix is still required because odd lengths remain valid for SCTP_PARAM_ERR_CAUSE per RFC 5061.
The issue was found by ZeroHive, a vulnerability hunting agent at Tencent Yunding Lab.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
This vulnerability represents a critical desynchronization flaw within the Stream Control Transmission Protocol (SCTP) implementation in the Linux kernel, specifically affecting the handling of Address Configuration Change Acknowledgment parameters during IPv4/IPv6 address addition operations. The core technical defect arises from an inconsistency between two distinct iteration mechanisms operating on the same data structure: sctp_verify_asconf() and sctp_get_asconf_response(). The verifier function utilizes sctp_walk_params(), which correctly advances through parameter buffers by rounding up lengths to four-byte boundaries using SCTP_PAD4 logic, adhering to RFC 5061 alignment requirements. Conversely, the consumer function iterates over these parameters by advancing strictly by the raw length field without applying padding adjustments. This discrepancy creates a state divergence where the two walks fall out of sync whenever an ASCONF-ACK parameter possesses an odd-length value. Such misalignment allows the consumer to interpret attacker-controlled bytes at incorrect memory offsets, fundamentally compromising data integrity and processing logic within the kernel network stack.
The operational impact of this desynchronization is severe, manifesting primarily as a remote denial-of-service condition through soft lockups in interrupt context. When the misaligned iteration causes the consumer to read a length field that evaluates to zero, the associated while loop fails to make any forward progress on the buffer pointer. This results in an infinite spin within the software interrupt handler, triggering kernel watchdog timeouts and effectively freezing network processing for the affected system or potentially causing broader system instability depending on resource contention. The attack vector is remote and does not require authentication bypass beyond standard SCTP handshake parameters; although RFC 5061 mandates that ASCONF-ACK chunks be authenticated via HMAC, the use of predefined empty key identifiers allows an attacker to compute valid association HMACs using publicly exchanged initialization data, thereby circumventing this security control. Consequently, any remote peer capable of establishing an SCTP association with ADD-IP enabled can trigger this denial-of-service condition by crafting malicious ASCONF-ACK chunks with odd-length parameters that result in zero-length reads during the desynchronized iteration phase.
A secondary but equally critical flaw exists within the handling of error cause parameters inside sctp_verify_asconf(). The verifier fails to perform adequate length validation for SCTP_PARAM_ERR_CAUSE entries, allowing malformed or truncated parameters lacking a complete error header structure to pass verification and reach the consumer logic. This oversight leads to an out-of-bounds read condition where the code attempts to access fields within errhdr.cause beyond the actual boundaries of the received parameter buffer. While this specific flaw primarily poses a risk for information disclosure through kernel memory leakage rather than immediate denial-of-service, it compounds the overall instability and security posture of the SCTP stack by allowing invalid data structures to propagate deeper into processing pipelines. The combination of these two flaws highlights systemic issues in boundary checking and iterator synchronization within complex protocol implementations.
Mitigation strategies involve both patching the underlying kernel code and implementing defensive network architecture practices. The primary remediation requires aligning the consumer iteration logic with the verifier’s padding rules, ensuring that sctp_get_asconf_response() advances by SCTP_PAD4(length) rather than raw length to maintain synchronization throughout processing. Additionally, strict length validation must be enforced for SCTP_PARAM_ERR_CAUSE parameters at the verification stage, rejecting any entry shorter than the sum of sizeof(struct sctp_addip_param) and sizeof(struct sctp_errhdr). This ensures that only well-formed error headers are processed, eliminating the out-of-bounds read vector. From a defensive perspective, organizations should deploy network intrusion detection systems capable of inspecting SCTP traffic for malformed parameter lengths and irregular chunk structures. Limiting exposure to untrusted networks by restricting SCTP service availability to trusted internal segments also reduces the attack surface. This vulnerability is classified under CWE-125 Out-of-bounds Read due to the memory access violation in error handling, and its exploitation aligns with ATT&CK technique T1498 Network Denial of Service, specifically involving resource exhaustion via infinite loops or soft lockups induced by crafted network packets.