{"id":"CVE-2026-98130","revision":"fe274c7141f746eb9db1cb20d4547a7a","records":[{"revision":"fe274c7141f746eb9db1cb20d4547a7a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98130","aliases":[],"title":"sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix a TOCTOU race in SCTP_CMD_TIMER_START\n\nThe SCTP_CMD_TIMER_START handler checks timer_pending() before calling\ntimer_reduce(). The timer can expire and detach between these operations,\ncausing timer_reduce() to rearm the timer without taking the association\nreference required for the newly armed timer.\n\nThe timer callback later unconditionally drops its association reference,\nwhich can leave the association reference count unbalanced and result in\nuse-after-free during association teardown.\n\nUse the return value of timer_reduce() to determine whether the timer was\nactually armed. Take the association reference only when timer_reduce()\nsuccessfully starts a new timer, closing the race between checking the\ntimer state and rearming it.\n\nThis issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero\nDay Initiative.","state":0,"publishedAt":"2026-09-25T10:36:10.243+00:00","modifiedAt":"2026-10-19T09:14:23.404+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sctp/sm_sideeffect.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"20a785aa52c82246055a089e55df9dac47d67da1\",\n                            \"lessThan\": \"cbf2df9aac4202f9fb0b361a7fe8c79b29fad92c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20a785aa52c82246055a089e55df9dac47d67da1\",\n                            \"lessThan\": \"3205a20f837f5b1f009427ac3d9f706bf8a6fbec\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20a785aa52c82246055a089e55df9dac47d67da1\",\n                            \"lessThan\": \"755d70ca845fd9b87c7b338ae6ae832b08cd0005\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20a785aa52c82246055a089e55df9dac47d67da1\",\n                            \"lessThan\": \"09e7f9290d63178f56095d5c18fb9f9470153db5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20a785aa52c82246055a089e55df9dac47d67da1\",\n                            \"lessThan\": \"e42ba56281ca3ae2dcb3558bebee9a1c9a4831d9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20a785aa52c82246055a089e55df9dac47d67da1\",\n                            \"lessThan\": \"00b841bac10230c557be6b38efc48508198fe23e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20a785aa52c82246055a089e55df9dac47d67da1\",\n                            \"lessThan\": \"3d698d1e6c8bc41e3e1707777a016f1bdd07842d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20a785aa52c82246055a089e55df9dac47d67da1\",\n                            \"lessThan\": \"2188569e7e1b0bc3f3b557dc97ab7a02befc11c8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9c0a4652f750afe3b4468cbcd9335b244ce2facd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"70989e501fbce502198d82da88358ce453575a05\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"085bb270b4b1168c93afb37bbafc881207d15443\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4.19.126\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.44\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.6.16\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sctp/sm_sideeffect.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/cbf2df9aac4202f9fb0b361a7fe8c79b29fad92c","https://git.kernel.org/stable/c/3205a20f837f5b1f009427ac3d9f706bf8a6fbec","https://git.kernel.org/stable/c/755d70ca845fd9b87c7b338ae6ae832b08cd0005","https://git.kernel.org/stable/c/09e7f9290d63178f56095d5c18fb9f9470153db5","https://git.kernel.org/stable/c/e42ba56281ca3ae2dcb3558bebee9a1c9a4831d9","https://git.kernel.org/stable/c/00b841bac10230c557be6b38efc48508198fe23e","https://git.kernel.org/stable/c/3d698d1e6c8bc41e3e1707777a016f1bdd07842d","https://git.kernel.org/stable/c/2188569e7e1b0bc3f3b557dc97ab7a02befc11c8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98130","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98130","identifiers":["CVE-2026-98130"]},"retained":false,"historicalAffected":[]}],"coverage":[]}