In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always…
CVE-2026-99128
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop() currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When ASCONF is covered by the association's SCTP-AUTH policy, sctpassocbhrcv() can continue before the state machine performs its normal chunk-length check. sctpinqpop() then returns the same malformed chunk repeatedly and the receive softirq can lock up. A remote SCTP peer can trigger this after establishing an association on a kernel built with CONFIGIPSCTP and configured with net.sctp.addipenable=1 and net.sctp.authenable=1. The reproducer did not require application credentials, a shared SCTP AUTH key, or net.sctp.addipnoauthenable=1. On commit f967455fb2a5 ("seg6: reset IP6CB after IPv6 decapsulation"), one zero-length ASCONF caused repeated watchdog soft-lockup reports in a two-vCPU KVM guest. All 3 pre-trigger health probes succeeded, while 36 of 37 post-trigger probes failed. With this change, all 37 post-trigger probes succeeded and no equivalent soft-lockup signature appeared. Reject…
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 30 October 2026
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
At the source
References
- https://git.kernel.org/stable/c/40507f59f230dcf60ae13cb48d34f8c6e9f40659
- https://git.kernel.org/stable/c/5a7ee52589dae36c93dc64d7a97c5ded84618572
- https://git.kernel.org/stable/c/6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a
- https://git.kernel.org/stable/c/9ac57e4c62e93c287b36080e5da3645690549990
- https://git.kernel.org/stable/c/b0dbd53b242609c88e81b0a49093bdbef5d5a418
- https://git.kernel.org/stable/c/cc4a4f1d6b6d725438dc37b97f03d95ed9feb63f
- https://git.kernel.org/stable/c/d28ea1a62e27210d8ea3cf496dfae85dbdd7b84f
- https://git.kernel.org/stable/c/e0fb7fe180488a5afa2e91509ea838e8df8cb771
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99128