Linux Kernel CVE-2026-98130

Requires the target kernel to have the SCTP protocol (CONFIG_IP_SCTP) built and an SCTP endpoint reachable so an attacker can establish an association and drive timer state transitions. Exploitation depends on winning a narrow timing race: the SCTP_CMD_TIMER_START handler must observe timer_pending() as true while the timer concurrently expires and detaches before timer_reduce() rearms it, leaving the association reference count unbalanced - this AC:H race window, not a deterministic input, is the primary limiting factor. No authentication or local privilege is required (SCTP associations are peer-initiated), but SCTP being disabled or unused in most deployments, plus the difficulty of reliably hitting the detach-between-check-and-rearm window, sharply limit realistic exploitability.

This is a classic Linux-kernel refcount/UAF flaw dressed up with an inflated CVSS. The NVD vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) claims full confidentiality AND integrity AND availability impact, but the description describes only a timer TOCTOU race that unbalances an association reference count and produces a use-after-free during teardown - a memory-corruption/crash primitive, not an information leak. The C:H/I:H assignment is therefore overstated; the realistic outcome is a kernel crash (DoS) with, at most, low integrity impact from corruption, so C:N/I:L/A:H is more honest. The AC:H is appropriate: exploitation depends on winning a narrow timing window where the timer expires and detaches between the timer_pending() check and timer_reduce(). AV:N/PR:N are defensible because SCTP associations are driven by network peers and require no local privilege, but reliably hitting the race remotely is much harder than the 8.1 suggests. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data - exploitation status is 'no public exploit identified at time of analysis,' though the report originated from Trend ZDI (Nico Yip, @_cyeaa_), indicating researcher-grade interest rather than in-the-wild use. The 'Information Disclosure' tag directly conflicts with the actual UAF/DoS behavior and should be treated as mislabeled. Net: a legitimate but hard-to-exploit, DoS-dominant kernel bug - patch it in SCTP-using fleets, but it is not a drop-everything network RCE despite the 8.1.

A remote peer opens an SCTP association to a Linux host and drives association state so that a management timer is repeatedly started while another expiring instance detaches, racing the timer_pending()/timer_reduce() window to leave the association reference count unbalanced. On association teardown the premature/extra reference drop frees the association while it is still referenced, triggering a use-after-free that typically panics the kernel. No public proof-of-concept is available; the issue was reported privately via Trend ZDI, and the AC:H timing dependency makes reliable exploitation difficult.