CVE-2026-98614

In the Linux kernel, the following vulnerability has been resolved:

sctp: avoid livelock while updating retransmit path

sctp_assoc_update_retran_path() can loop forever when every remaining

transport, including retran_path, is SCTP_UNCONFIRMED: the state check

runs before the wraparound test, so the loop cannot observe that it has

completed a full pass.

Fix this by considering a transport only when it is not UNCONFIRMED,

then checking whether the walk has returned to retran_path. This makes

the full-pass termination independent of the transport state while

preserving the existing fallback selection semantics.

Also restore the NULL guard around the retran_path assignment. In the

all-UNCONFIRMED case there is no eligible replacement transport, and

installing NULL would leave later retransmit-path users and the debug

print with a NULL path.