CVE-2026-98614

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98614", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.360Z", "datePublished": "2026-10-18T15:19:34.494Z", "dateUpdated": "2026-10-19T09:22:42.185Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:42.185Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid livelock while updating retransmit path\n\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNCONFIRMED: the state check\nruns before the wraparound test, so the loop cannot observe that it has\ncompleted a full pass.\n\nFix this by considering a transport only when it is not UNCONFIRMED,\nthen checking whether the walk has returned to retran_path. This makes\nthe full-pass termination independent of the transport state while\npreserving the existing fallback selection semantics.\n\nAlso restore the NULL guard around the retran_path assignment. In the\nall-UNCONFIRMED case there is no eligible replacement transport, and\ninstalling NULL would leave later retransmit-path users and the debug\nprint with a NULL path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/associola.c"], "versions": [{"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "lessThan": "3fe624c3843694ab096fdb198526ba0c659febbe", "status": "affected", "versionType": "git"}, {"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "lessThan": "43410c1f2db53516e95ddd7e5b4b02f495b78121", "status": "affected", "versionType": "git"}, {"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "lessThan": "d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49", "status": "affected", "versionType": "git"}, {"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "lessThan": "83b1a7f9e718828ef364a7b004254ebb2d0035fe", "status": "affected", "versionType": "git"}, {"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "lessThan": "173610fff55022a5ad1579fbcc7faa97467b58b7", "status": "affected", "versionType": "git"}, {"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "lessThan": "c9338057df1025f578fe7d0ff08bada87b8b838d", "status": "affected", "versionType": "git"}, {"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "lessThan": "ddc34cc0834c873871e88b055ee6a260676efe97", "status": "affected", "versionType": "git"}, {"version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "lessThan": "d2c31b837406395e576afeb25958c98e9938f3f6", "status": "affected", "versionType": "git"}, {"version": "8ceaec02b17397d12719a282945abc95f8149d9f", "status": "affected", "versionType": "git"}, {"version": "d2c2bdcdd8c5ce3d2a68aa3353ed1f340c3e500e", "status": "affected", "versionType": "git"}, {"version": "3.10.106", "lessThan": "3.11", "status": "affected", "versionType": "semver"}, {"version": "3.12.71", "lessThan": "3.13", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/associola.c"], "versions": [{"version": "3.14", "status": "affected"}, {"version": "0", "lessThan": "3.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10.106"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12.71"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3fe624c3843694ab096fdb198526ba0c659febbe"}, {"url": "https://git.kernel.org/stable/c/43410c1f2db53516e95ddd7e5b4b02f495b78121"}, {"url": "https://git.kernel.org/stable/c/d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49"}, {"url": "https://git.kernel.org/stable/c/83b1a7f9e718828ef364a7b004254ebb2d0035fe"}, {"url": "https://git.kernel.org/stable/c/173610fff55022a5ad1579fbcc7faa97467b58b7"}, {"url": "https://git.kernel.org/stable/c/c9338057df1025f578fe7d0ff08bada87b8b838d"}, {"url": "https://git.kernel.org/stable/c/ddc34cc0834c873871e88b055ee6a260676efe97"}, {"url": "https://git.kernel.org/stable/c/d2c31b837406395e576afeb25958c98e9938f3f6"}], "title": "sctp: avoid livelock while updating retransmit path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sctp/associola.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3fe624c3843694ab096fdb198526ba0c659febbe", "status": "affected", "version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "versionType": "git"}, {"lessThan": "43410c1f2db53516e95ddd7e5b4b02f495b78121", "status": "affected", "version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "versionType": "git"}, {"lessThan": "d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49", "status": "affected", "version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "versionType": "git"}, {"lessThan": "83b1a7f9e718828ef364a7b004254ebb2d0035fe", "status": "affected", "version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "versionType": "git"}, {"lessThan": "173610fff55022a5ad1579fbcc7faa97467b58b7", "status": "affected", "version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "versionType": "git"}, {"lessThan": "c9338057df1025f578fe7d0ff08bada87b8b838d", "status": "affected", "version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "versionType": "git"}, {"lessThan": "ddc34cc0834c873871e88b055ee6a260676efe97", "status": "affected", "version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "versionType": "git"}, {"lessThan": "d2c31b837406395e576afeb25958c98e9938f3f6", "status": "affected", "version": "4c47af4d5eb2c2f78f886079a3920a7078a6f0a0", "versionType": "git"}, {"status": "affected", "version": "8ceaec02b17397d12719a282945abc95f8149d9f", "versionType": "git"}, {"status": "affected", "version": "d2c2bdcdd8c5ce3d2a68aa3353ed1f340c3e500e", "versionType": "git"}, {"lessThan": "3.11", "status": "affected", "version": "3.10.106", "versionType": "semver"}, {"lessThan": "3.13", "status": "affected", "version": "3.12.71", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sctp/associola.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"lessThan": "3.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid livelock while updating retransmit path\n\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNCONFIRMED: the state check\nruns before the wraparound test, so the loop cannot observe that it has\ncompleted a full pass.\n\nFix this by considering a transport only when it is not UNCONFIRMED,\nthen checking whether the walk has returned to retran_path. This makes\nthe full-pass termination independent of the transport state while\npreserving the existing fallback selection semantics.\n\nAlso restore the NULL guard around the retran_path assignment. In the\nall-UNCONFIRMED case there is no eligible replacement transport, and\ninstalling NULL would leave later retransmit-path users and the debug\nprint with a NULL path."}], "id": "CVE-2026-98614", "lastModified": "2026-10-19T10:19:25.303", "metrics": {}, "published": "2026-10-18T16:17:14.267", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/173610fff55022a5ad1579fbcc7faa97467b58b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3fe624c3843694ab096fdb198526ba0c659febbe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/43410c1f2db53516e95ddd7e5b4b02f495b78121"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/83b1a7f9e718828ef364a7b004254ebb2d0035fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c9338057df1025f578fe7d0ff08bada87b8b838d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d2c31b837406395e576afeb25958c98e9938f3f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ddc34cc0834c873871e88b055ee6a260676efe97"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: sctp: avoid livelock while updating retransmit path", "id": "2554974", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554974"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsctp: avoid livelock while updating retransmit path\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNCONFIRMED: the state check\nruns before the wraparound test, so the loop cannot observe that it has\ncompleted a full pass.\nFix this by considering a transport only when it is not UNCONFIRMED,\nthen checking whether the walk has returned to retran_path. This makes\nthe full-pass termination independent of the transport state while\npreserving the existing fallback selection semantics.\nAlso restore the NULL guard around the retran_path assignment. In the\nall-UNCONFIRMED case there is no eligible replacement transport, and\ninstalling NULL would leave later retransmit-path users and the debug\nprint with a NULL path.", "A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. An attacker could exploit this vulnerability to cause a Denial of Service (DoS) by triggering an infinite loop during retransmission path selection. When all candidate network paths are in an unconfirmed state, the kernel fails to recognize the completion of its search loop, resulting in system livelock and CPU starvation."], "name": "CVE-2026-98614", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98614\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98614\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98614.mbox"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4c47af4d5eb2c2f78f886079a3920a7078a6f0a0,3fe624c3843694ab096fdb198526ba0c659febbe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4c47af4d5eb2c2f78f886079a3920a7078a6f0a0,43410c1f2db53516e95ddd7e5b4b02f495b78121)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4c47af4d5eb2c2f78f886079a3920a7078a6f0a0,d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4c47af4d5eb2c2f78f886079a3920a7078a6f0a0,83b1a7f9e718828ef364a7b004254ebb2d0035fe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4c47af4d5eb2c2f78f886079a3920a7078a6f0a0,173610fff55022a5ad1579fbcc7faa97467b58b7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4c47af4d5eb2c2f78f886079a3920a7078a6f0a0,c9338057df1025f578fe7d0ff08bada87b8b838d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4c47af4d5eb2c2f78f886079a3920a7078a6f0a0,ddc34cc0834c873871e88b055ee6a260676efe97)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4c47af4d5eb2c2f78f886079a3920a7078a6f0a0,d2c31b837406395e576afeb25958c98e9938f3f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8ceaec02b17397d12719a282945abc95f8149d9f"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "d2c2bdcdd8c5ce3d2a68aa3353ed1f340c3e500e"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.10.106,3.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.12.71,3.13)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.271,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.222,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.189,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.158,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.112,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.55,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.9,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T18:30:14.376192+00:00", "updated": "2026-10-22T21:45:06.450658+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}