{"id":"CVE-2026-98614","title":"sctp: avoid livelock while updating retransmit path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid livelock while updating retransmit path\n\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNC…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < 3fe624c3843694ab096fdb198526ba0c659febbe","Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < 43410c1f2db53516e95ddd7e5b4b02f495b78121","Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49","Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < 83b1a7f9e718828ef364a7b004254ebb2d0035fe","Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < 173610fff55022a5ad1579fbcc7faa97467b58b7","Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < c9338057df1025f578fe7d0ff08bada87b8b838d","Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < ddc34cc0834c873871e88b055ee6a260676efe97","Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < d2c31b837406395e576afeb25958c98e9938f3f6","Linux 8ceaec02b17397d12719a282945abc95f8149d9f","Linux d2c2bdcdd8c5ce3d2a68aa3353ed1f340c3e500e","Linux >= 3.10.106 < 3.11","Linux >= 3.12.71 < 3.13","Linux 3.14"],"published":"2026-10-18","updated":"2026-10-19","sourceUpdated":"2026-10-19T09:22:42.185Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98614","references":[{"url":"https://git.kernel.org/stable/c/3fe624c3843694ab096fdb198526ba0c659febbe"},{"url":"https://git.kernel.org/stable/c/43410c1f2db53516e95ddd7e5b4b02f495b78121"},{"url":"https://git.kernel.org/stable/c/d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49"},{"url":"https://git.kernel.org/stable/c/83b1a7f9e718828ef364a7b004254ebb2d0035fe"},{"url":"https://git.kernel.org/stable/c/173610fff55022a5ad1579fbcc7faa97467b58b7"},{"url":"https://git.kernel.org/stable/c/c9338057df1025f578fe7d0ff08bada87b8b838d"},{"url":"https://git.kernel.org/stable/c/ddc34cc0834c873871e88b055ee6a260676efe97"},{"url":"https://git.kernel.org/stable/c/d2c31b837406395e576afeb25958c98e9938f3f6"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.240Z","slug":"CVE-2026-98614","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid livelock while updating retransmit path\n\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNCONFIRMED: the state check\nruns before the wraparound test, so the loop cannot observe that it has\ncompleted a full pass.\n\nFix this by considering a transport only when it is not UNCONFIRMED,\nthen checking whether the walk has returned to retran_path. This makes\nthe full-pass termination independent of the transport state while\npreserving the existing fallback selection semantics.\n\nAlso restore the NULL guard around the retran_path assignment. In the\nall-UNCONFIRMED case there is no eligible replacement transport, and\ninstalling NULL would leave later retransmit-path users and the debug\nprint with a NULL path.\n\n## Affected\n\n- `Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < 3fe624c3843694ab096fdb198526ba0c659febbe`\n- `Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < 43410c1f2db53516e95ddd7e5b4b02f495b78121`\n- `Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49`\n- `Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < 83b1a7f9e718828ef364a7b004254ebb2d0035fe`\n- `Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < 173610fff55022a5ad1579fbcc7faa97467b58b7`\n- `Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < c9338057df1025f578fe7d0ff08bada87b8b838d`\n- `Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < ddc34cc0834c873871e88b055ee6a260676efe97`\n- `Linux >= 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 < d2c31b837406395e576afeb25958c98e9938f3f6`\n- `Linux 8ceaec02b17397d12719a282945abc95f8149d9f`\n- `Linux d2c2bdcdd8c5ce3d2a68aa3353ed1f340c3e500e`\n- `Linux >= 3.10.106 < 3.11`\n- `Linux >= 3.12.71 < 3.13`\n- `Linux 3.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}