{"cve":"CVE-2026-99128","nvd":{"published":"2026-10-28T11:17:32.570","modified":"2026-10-28T11:17:32.570","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate chunk length in the inqueue parser\n\nSCTP chunks always include a four-byte generic header, but\nsctp_inq_pop() currently accepts shorter declared lengths. A zero-length\nchunk leaves chunk_end at the current header.\n\nWhen ASCONF is covered by the association's SCTP-AUTH policy,\nsctp_assoc_bh_rcv() can continue before the state machine performs its\nnormal chunk-length check. sctp_inq_pop() then returns the same malformed\nchunk repeatedly and the receive softirq can lock up.\n\nA remote SCTP peer can trigger this after establishing an association on\na kernel built with CONFIG_IP_SCTP and configured with\nnet.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did\nnot require application credentials, a shared SCTP AUTH key, or\nnet.sctp.addip_noauth_enable=1.\n\nOn commit f967455fb2a5 (\"seg6: reset IP6CB after IPv6 decapsulation\"),\none zero-length ASCONF caused repeated\nwatchdog soft-lockup reports in a two-vCPU KVM guest. All 3 pre-trigger\nhealth probes succeeded, while 36 of 37 post-trigger probes failed. With\nthis change, all 37 post-trigger probes succeeded and no equivalent\nsoft-lockup signature appeared.\n\nReject chunks shorter than the generic SCTP header at the shared inqueue\nparser boundary. Mark the packet for discard before either caller can\ncontinue processing it, while preserving the four-byte generic minimum.\nDeclared-length 1 through 4 controls and kernel-generated ASCONF traffic\nremained healthy. The patched sctp_hello selftest passed for IPv4 and\nIPv6.\n\nThe complete private reproducer and validation evidence are available\ndirectly to maintainers on request.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/40507f59f230dcf60ae13cb48d34f8c6e9f40659","https://git.kernel.org/stable/c/6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a","https://git.kernel.org/stable/c/9ac57e4c62e93c287b36080e5da3645690549990"],"products":[],"source":"nvd","synced_at":"2026-10-28T11:37:51.394563875+00:00"},"epss":null,"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}