{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-98123 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98123 is a medium-severity denial of service vulnerability in Linux kernel, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98123 and fix it if it is affected.\n\nWhat it is: CVE-2026-98123 is a medium-severity denial of service vulnerability in Linux kernel, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98123 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98123/ (Markdown: https://insights.sbomify.com/CVE-2026-98123/index.md)","id":"CVE-2026-98123","markdown":"https://insights.sbomify.com/CVE-2026-98123/index.md","name":"CVE-2026-98123","record":{"aliases":["AZL-104796","BELL-CVE-2026-98123","DEBIAN-CVE-2026-98123","GHSA-f2r5-8634-vv9q","UBUNTU-CVE-2026-98123"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel SCTP","requires_auth":"none","summary":"Remote attackers can cause a kernel soft lockup and denial of service by sending crafted SCTP ASCONF-ACK chunks to Linux systems.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-667","name":"Improper Locking"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration\n\nsctp_verify_asconf() walks ASCONF-ACK parameters with\nsctp_walk_params(), which advances by SCTP_PAD4(length), while the\nconsumer sctp_get_asconf_response() iterates the same parameters\nadvancing by the raw length, without padding. A single odd-length\nparameter desynchronises the two walks and makes the consumer\ninterpret attacker-controlled bytes at a misaligned offset.\n\nWhen those bytes yield a length of zero, the while loop over\nasconf_ack_len makes no progress, spinning forever in softirq\ncontext, and the watchdog reports a soft lockup. All reads stay\nwithin the received skb, so the lockup is a pure remote denial of\nservice. A remote peer can trigger it with a crafted ASCONF-ACK on\nan ADD-IP enabled association with an outstanding ASCONF (RFC 5061\nsection 4.1.2 requires the chunk to be authenticated, but the\npredefined empty key id 0 allows the peer to compute the same\nassociation HMAC from publicly exchanged parameters, so the gate\ndoes not help).\n\nThe SCTP_PARAM_ERR_CAUSE case of sctp_verify_asconf() also performs\nno length check, letting a parameter without a complete error\nheader reach the consumer, which reads errhdr.cause past the end of\nthe parameter, an out-of-bounds read.\n\nReject SCTP_PARAM_ERR_CAUSE parameters shorter than\nsizeof(struct sctp_addip_param) + sizeof(struct sctp_errhdr) at the\nverifier, and advance the consumer iterator with the same padding\nrule as the verifier to keep the two walks in lockstep. The verifier\nchange guarantees a complete error header in every ERR_CAUSE\nparameter the consumer can see, so the consumer's asconf_ack_len\ncheck is dropped and it returns err_param-\u003ecause directly. The\nconsumer padding fix is still required because odd lengths remain\nvalid for SCTP_PARAM_ERR_CAUSE per RFC 5061.\n\nThe issue was found by ZeroHive, a vulnerability hunting agent at\nTencent Yunding Lab.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration","id":"CVE-2026-98123","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"smb/client: invalidate fscache for fallocate range operations","id":"CVE-2026-98124"},"packages":[],"prev":{"headline":"vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()","id":"CVE-2026-98122"},"products":["Linux"],"published":"2026-09-25","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"Remote attackers can cause a kernel soft lockup and denial of service by sending crafted SCTP ASCONF-ACK chunks to Linux systems.","url":"https://insights.sbomify.com/CVE-2026-98123/"}