Linux kernel is core infrastructure; a kernel memory-corruption bug in SCTP can impact servers and network devices broadly and merits wide distribution.
CVE-2026-98130
Linux kernel SCTP TOCTOU race causes use-after-free in timer handling.
Is CVE-2026-98130 being exploited?
Not confirmed. CVE-2026-98130 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked.
How severe is CVE-2026-98130?
CVE-2026-98130 is rated High with a CVSS score of 8.1. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-98130?
Yes. A fix has been recorded for CVE-2026-98130. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-98130 affect?
CVE-2026-98130 affects Linux kernel (SCTP subsystem), Servers with SCTP enabled, Network appliances running Linux. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-98130?
Install kernel updates with the SCTP fix and reboot affected hosts.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
SCTP timer race leads to kernel use-after-free, enabling denial-of-service or possible kernel memory corruption and potential code execution.
Patch when possible
- affected>= 20a785aa52c82246055a089e55df9dac47d67da1 and < e42ba56281ca3ae2dcb3558bebee9a1c9a4831d9
- affected>= 20a785aa52c82246055a089e55df9dac47d67da1 and < 00b841bac10230c557be6b38efc48508198fe23e
- affected>= 20a785aa52c82246055a089e55df9dac47d67da1 and < 3d698d1e6c8bc41e3e1707777a016f1bdd07842d
- affected>= 20a785aa52c82246055a089e55df9dac47d67da1 and < 2188569e7e1b0bc3f3b557dc97ab7a02befc11c8
- affected9c0a4652f750afe3b4468cbcd9335b244ce2facd
- affected70989e501fbce502198d82da88358ce453575a05
- affected085bb270b4b1168c93afb37bbafc881207d15443
- affected>= 4.19.126 and < 4.20
- affected>= 5.4.44 and < 5.5
- affected>= 5.6.16 and < 5.7
- affected5.7
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.