SB20261029190 - Infinite loop in Linux kernel sctp

Description

This security bulletin contains information about 1 vulnerability.

1) Infinite loop (CVE-ID: CVE-2026-99128)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by locking up the kernel's receive softirq.

The vulnerability exists due to insufficient chunk-length validation in the SCTP inqueue parser, sctp_inq_pop(), when processing incoming SCTP chunks. A remote attacker can send a zero-length ASCONF chunk over an established association whose SCTP-AUTH policy covers ASCONF to cause repeated processing of the same malformed chunk and lock up the receive softirq.

Exploitation requires net.sctp.addip_enable=1 and net.sctp.auth_enable=1.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/40507f59f230dcf60ae13cb48d34f8c6e9f40659
• https://git.kernel.org/stable/c/6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a
• https://git.kernel.org/stable/c/9ac57e4c62e93c287b36080e5da3645690549990