CVE-2026-99128

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99128", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.394Z", "datePublished": "2026-10-28T10:34:42.229Z", "dateUpdated": "2026-10-30T12:42:02.124Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:42:02.124Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate chunk length in the inqueue parser\n\nSCTP chunks always include a four-byte generic header, but\nsctp_inq_pop() currently accepts shorter declared lengths. A zero-length\nchunk leaves chunk_end at the current header.\n\nWhen ASCONF is covered by the association's SCTP-AUTH policy,\nsctp_assoc_bh_rcv() can continue before the state machine performs its\nnormal chunk-length check. sctp_inq_pop() then returns the same malformed\nchunk repeatedly and the receive softirq can lock up.\n\nA remote SCTP peer can trigger this after establishing an association on\na kernel built with CONFIG_IP_SCTP and configured with\nnet.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did\nnot require application credentials, a shared SCTP AUTH key, or\nnet.sctp.addip_noauth_enable=1.\n\nOn commit f967455fb2a5 (\"seg6: reset IP6CB after IPv6 decapsulation\"),\none zero-length ASCONF caused repeated\nwatchdog soft-lockup reports in a two-vCPU KVM guest. All 3 pre-trigger\nhealth probes succeeded, while 36 of 37 post-trigger probes failed. With\nthis change, all 37 post-trigger probes succeeded and no equivalent\nsoft-lockup signature appeared.\n\nReject chunks shorter than the generic SCTP header at the shared inqueue\nparser boundary. Mark the packet for discard before either caller can\ncontinue processing it, while preserving the four-byte generic minimum.\nDeclared-length 1 through 4 controls and kernel-generated ASCONF traffic\nremained healthy. The patched sctp_hello selftest passed for IPv4 and\nIPv6.\n\nThe complete private reproducer and validation evidence are available\ndirectly to maintainers on request."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/inqueue.c"], "versions": [{"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "cc4a4f1d6b6d725438dc37b97f03d95ed9feb63f", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "b0dbd53b242609c88e81b0a49093bdbef5d5a418", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "d28ea1a62e27210d8ea3cf496dfae85dbdd7b84f", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "5a7ee52589dae36c93dc64d7a97c5ded84618572", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "e0fb7fe180488a5afa2e91509ea838e8df8cb771", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "40507f59f230dcf60ae13cb48d34f8c6e9f40659", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "9ac57e4c62e93c287b36080e5da3645690549990", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/inqueue.c"], "versions": [{"version": "2.6.24", "status": "affected"}, {"version": "0", "lessThan": "2.6.24", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cc4a4f1d6b6d725438dc37b97f03d95ed9feb63f"}, {"url": "https://git.kernel.org/stable/c/b0dbd53b242609c88e81b0a49093bdbef5d5a418"}, {"url": "https://git.kernel.org/stable/c/d28ea1a62e27210d8ea3cf496dfae85dbdd7b84f"}, {"url": "https://git.kernel.org/stable/c/5a7ee52589dae36c93dc64d7a97c5ded84618572"}, {"url": "https://git.kernel.org/stable/c/e0fb7fe180488a5afa2e91509ea838e8df8cb771"}, {"url": "https://git.kernel.org/stable/c/40507f59f230dcf60ae13cb48d34f8c6e9f40659"}, {"url": "https://git.kernel.org/stable/c/9ac57e4c62e93c287b36080e5da3645690549990"}, {"url": "https://git.kernel.org/stable/c/6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a"}], "title": "sctp: validate chunk length in the inqueue parser", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sctp/inqueue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cc4a4f1d6b6d725438dc37b97f03d95ed9feb63f", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "b0dbd53b242609c88e81b0a49093bdbef5d5a418", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "d28ea1a62e27210d8ea3cf496dfae85dbdd7b84f", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "5a7ee52589dae36c93dc64d7a97c5ded84618572", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "e0fb7fe180488a5afa2e91509ea838e8df8cb771", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "40507f59f230dcf60ae13cb48d34f8c6e9f40659", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "9ac57e4c62e93c287b36080e5da3645690549990", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sctp/inqueue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.24"}, {"lessThan": "2.6.24", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate chunk length in the inqueue parser\n\nSCTP chunks always include a four-byte generic header, but\nsctp_inq_pop() currently accepts shorter declared lengths. A zero-length\nchunk leaves chunk_end at the current header.\n\nWhen ASCONF is covered by the association's SCTP-AUTH policy,\nsctp_assoc_bh_rcv() can continue before the state machine performs its\nnormal chunk-length check. sctp_inq_pop() then returns the same malformed\nchunk repeatedly and the receive softirq can lock up.\n\nA remote SCTP peer can trigger this after establishing an association on\na kernel built with CONFIG_IP_SCTP and configured with\nnet.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did\nnot require application credentials, a shared SCTP AUTH key, or\nnet.sctp.addip_noauth_enable=1.\n\nOn commit f967455fb2a5 (\"seg6: reset IP6CB after IPv6 decapsulation\"),\none zero-length ASCONF caused repeated\nwatchdog soft-lockup reports in a two-vCPU KVM guest. All 3 pre-trigger\nhealth probes succeeded, while 36 of 37 post-trigger probes failed. With\nthis change, all 37 post-trigger probes succeeded and no equivalent\nsoft-lockup signature appeared.\n\nReject chunks shorter than the generic SCTP header at the shared inqueue\nparser boundary. Mark the packet for discard before either caller can\ncontinue processing it, while preserving the four-byte generic minimum.\nDeclared-length 1 through 4 controls and kernel-generated ASCONF traffic\nremained healthy. The patched sctp_hello selftest passed for IPv4 and\nIPv6.\n\nThe complete private reproducer and validation evidence are available\ndirectly to maintainers on request."}], "id": "CVE-2026-99128", "lastModified": "2026-10-30T13:21:47.040", "metrics": {}, "published": "2026-10-28T11:17:32.570", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/40507f59f230dcf60ae13cb48d34f8c6e9f40659"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5a7ee52589dae36c93dc64d7a97c5ded84618572"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ac57e4c62e93c287b36080e5da3645690549990"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b0dbd53b242609c88e81b0a49093bdbef5d5a418"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc4a4f1d6b6d725438dc37b97f03d95ed9feb63f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d28ea1a62e27210d8ea3cf496dfae85dbdd7b84f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e0fb7fe180488a5afa2e91509ea838e8df8cb771"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via improper SCTP chunk length validation", "id": "2562685", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562685"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsctp: validate chunk length in the inqueue parser\nSCTP chunks always include a four-byte generic header, but\nsctp_inq_pop() currently accepts shorter declared lengths. A zero-length\nchunk leaves chunk_end at the current header.\nWhen ASCONF is covered by the association's SCTP-AUTH policy,\nsctp_assoc_bh_rcv() can continue before the state machine performs its\nnormal chunk-length check. sctp_inq_pop() then returns the same malformed\nchunk repeatedly and the receive softirq can lock up.\nA remote SCTP peer can trigger this after establishing an association on\na kernel built with CONFIG_IP_SCTP and configured with\nnet.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did\nnot require application credentials, a shared SCTP AUTH key, or\nnet.sctp.addip_noauth_enable=1.\nOn commit f967455fb2a5 (\"seg6: reset IP6CB after IPv6 decapsulation\"),\none zero-length ASCONF caused repeated\nwatchdog soft-lockup reports in a two-vCPU KVM guest. All 3 pre-trigger\nhealth probes succeeded, while 36 of 37 post-trigger probes failed. With\nthis change, all 37 post-trigger probes succeeded and no equivalent\nsoft-lockup signature appeared.\nReject chunks shorter than the generic SCTP header at the shared inqueue\nparser boundary. Mark the packet for discard before either caller can\ncontinue processing it, while preserving the four-byte generic minimum.\nDeclared-length 1 through 4 controls and kernel-generated ASCONF traffic\nremained healthy. The patched sctp_hello selftest passed for IPv4 and\nIPv6.\nThe complete private reproducer and validation evidence are available\ndirectly to maintainers on request.", "A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. A remote attacker can exploit this vulnerability to cause a Denial of Service (DoS) by sending specially crafted network packets with invalid chunk lengths. Because the packet parser fails to properly validate declared chunk lengths, the packet receiver repeatedly processes the malformed chunk in an infinite loop, resulting in a system soft lockup."], "name": "CVE-2026-99128", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:34:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99128\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99128\nhttps://git.kernel.org/stable/c/40507f59f230dcf60ae13cb48d34f8c6e9f40659\nhttps://git.kernel.org/stable/c/6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a\nhttps://git.kernel.org/stable/c/9ac57e4c62e93c287b36080e5da3645690549990"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,40507f59f230dcf60ae13cb48d34f8c6e9f40659)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,9ac57e4c62e93c287b36080e5da3645690549990)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.24"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.24)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,40507f59f230dcf60ae13cb48d34f8c6e9f40659)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,9ac57e4c62e93c287b36080e5da3645690549990)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.24"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.24)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T11:45:09.959539+00:00", "updated": "2026-10-30T06:30:09.658825+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}