CVE-2026-98586

In the Linux kernel, the following vulnerability has been resolved:

sctp: hold asoc or transport before mod_timer() in timer handlers

Take the association or transport reference before rearming a timer in the

timer handlers.

The existing code calls mod_timer() before taking the reference needed by

the rearmed timer without holding the sock lock. This creates a race with

timer cleanup: if the timer is deleted after mod_timer() returns but before

the reference is taken, the cleanup path can drop the timer's reference and

destroy the transport or association. The timer handler then takes a

reference on the already freed object and eventually drops it, causing a

refcount underflow.

Hold the object before mod_timer() and drop the reference if mod_timer()

reports that the timer was already pending in timer handlers. Apply the

same ordering to the proto-unreachable path, which can rearm a transport

timer outside the timer handlers without holding the sock lock.