CVE-2026-98586
In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before mod_timer() in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls mod_timer() before taking the reference needed by the rearmed timer without holding the sock lock. This creates a race with timer cleanup: if the timer is deleted after mod_timer() returns but before the reference is taken, the cleanup path can drop the timer's reference and destroy the transport or association. The timer handler then takes a reference on the already freed object and eventually drops it, causing a refcount underflow. Hold the object before mod_timer() and drop the reference if mod_timer() reports that the timer was already pending in timer handlers. Apply the same ordering to the proto-unreachable path, which can rearm a transport timer outside the timer handlers without holding the sock lock.
Affected versions
Linux kernel versions
2.6.12
and later are affected. Fixed in
5.15.222,
6.1.189,
6.6.158,
6.12.112,
6.18.55,
7.2.9,
7.3
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-98586?
CVE-2026-98586 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.12 onward and has been patched in 5.15.222, 6.1.189, 6.6.158 and others. CVE-2026-98586 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98586?
Yes. CVE-2026-98586 has been patched. Fixed versions include 5.15.222, 6.1.189, 6.6.158 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98586 actively exploited?
No. CVE-2026-98586 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.