Linux Kernel: SCTP race condition allows privilege escalation

Zero Day Initiative published an advisory for CVE-2026-98130 in the Linux Kernel. The flaw is in the SCTP subsystem; the fix is referenced by commit 2188569e7e1b0bc3f3b557dc97ab7a02befc11c8. View the Zero Day Initiative advisory.

Overview and technical details

The Linux Kernel is the Linux operating system kernel, managing system resources and providing core services to software. CVE-2026-98130 is a race condition in the SCTP subsystem, involving access to sctp_association objects without appropriate locking.

Affected systems

The flaw is identified in the Linux Kernel SCTP subsystem. The record does not specify affected branches or versions, nor does it provide a fixed version. Therefore, a system's safety cannot be determined from a generic version number alone.

Mechanism and impact

Operating on an sctp_association object without appropriate locking creates a race condition. An attacker must be able to run code with low privileges on the system. Successful exploitation may allow privilege escalation and code execution in kernel context.

System checks

1. Check the kernel version currently running:

   Copy commands

   uname -r

2. Compare the version with update information from the Linux vendor for the distribution in use. The record provides no fixed version number to determine safety from the command output alone.

Remediation and mitigation

1. Install the Linux update that fixes the vulnerability. Prioritize systems with untrusted local users.

2. The fix is referenced by commit 2188569e7e1b0bc3f3b557dc97ab7a02befc11c8. The record does not specify a fixed version.

References

• Zero Day Initiative: ZDI-26-1001