HIGH
sctp TimerStart Race
CVE-2026-98130
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). The timer can expire and detach between these operations, causing timer_reduce() to rearm the timer without taking the association reference required for the newly armed timer. The timer callback later unconditionally drops its association reference, which can leave the association reference count unbalanced and result in use-after-free during association teardown. Use the return value of timer_reduce() to determine whether the timer was actually armed. Take the association reference only when timer_reduce() successfully starts a new timer, closing the race between checking the timer state and rearming it. This issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero Day Initiative.
02KernelScan AI Analysis
Risk summary
A race condition in the SCTP protocol's timer handling allows an attacker to trigger a use-after-free in the kernel. Remote attackers who can send SCTP packets to a target, or local unprivileged users who can create SCTP sockets, can exploit this to corrupt kernel memory, potentially leading to code execution or system crash. The race requires precise timing but can be driven by controlling packet or syscall timing.
Vulnerability analysis
The SCTP state machine has a time-of-check-to-time-of-use race in how it starts timers. When the state machine decides to start a timer, it checks whether the timer is already pending and only takes an association reference when it believes a new timer needs arming. Between that check and the actual arming call, the timer can expire and detach, so the timer gets rearmed without the required reference being taken. The timer callback later drops its association reference unconditionally, leaving the count unbalanced and freeing the association while it is still referenced, causing a use-after-free during teardown. The fix checks the return value of the timer arming function instead of pre-checking timer state, and takes the association reference only when a new timer was actually armed. This is reachable over the network by sending SCTP packets to a target running SCTP, or locally by any user who can create SCTP sockets, though exploiting the race requires precise timing.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 4.19 | 4.19.126 | 4.20 | cbf2df9aac42 |
| 5.4 | 5.4.44 | 5.5 | 3205a20f837f |
| 5.6 | 5.6.16 | 5.7 | 755d70ca845f |
| 5.10 | — | 5.10.271 | 09e7f9290d63 |
| 5.15 | — | 5.15.222 | e42ba56281ca |
| 6.1 | — | 6.1.189 | 00b841bac102 |
| 6.6 | — | 6.6.158 | 3d698d1e6c8b |
| 6.12 | — | 6.12.111 | 2188569e7e1b |
| 6.18 | — | 6.18.53 | — |
| 7.2 | — | 7.2.7 | — |
| mainline | — | 7.3-rc2 | — |
| cip/6.12 | — | 6.12.111-cip32 | e42ba56281ca |