CVE-2026-98548: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-3mq3-vc9v-9wmc
Share
Published
Advisory Summary

CVE-2026-98548 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98548 at a Glance

CVE Identifier CVE-2026-98548
GHSA Identifier GHSA-3mq3-vc9v-9wmc
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98548

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98548, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary addresses, processing the ERROR chunk takes the non-fatal stale-cookie retry path sctp_sf_do_5_2_6_stale(), which queues SCTP_CMD_DEL_NON_PRIMARY while keeping the association alive. sctp_cmd_del_non_primary() removes every non-primary transport - including the very transport this packet arrived on, which is still referenced by the receive lookup and shared by all chunks of the packet via chunk->transport. sctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from the removed transport, but right afterwards the bundled DATA chunk makes sctp_assoc_bh_rcv() re-register asoc->peer.last_data_from = chunk->transport unconditionally, undoing the redirection with the just-removed transport. Once the packet is done, the receive reference is dropped and the transport is RCU-freed, while the surviving association keeps the dangling last_data_from. A later FWD-TSN (or the delayed SACK timer) makes sctp_gen_sack() dereference it (->param_flags and friends), and sctp_make_sack()/sctp_outq_select_transport() may write to the freed object and link it into the live transport list. This is a use-after-free triggerable by any malicious SCTP peer (or a local unprivileged user acting as one) with no capabilities required: BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660 Read of size 4 at addr ffff88800e1e356c by task poc/115 Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <- sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv Allocated: sctp_transport_new <- sctp_assoc_add_peer <- sctp_process_init (INIT-ACK processing) Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core (call_rcu queued by sctp_transport_put at end of sctp_rcv) The buggy address is located 364 bytes inside of freed 1024-byte region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k Note that commit 03a9d10ecf71 ("sctp: drop a chunk if its transport was removed") only covers the window between the receive lookup and the chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog); here the transport is removed *while* the packet is being processed, by an earlier chunk of the same packet, so the drop in sctp_inq_push() does not reach this path. Verified with the bundled [ERROR(Stale Cookie)][DATA] + FWD-TSN reproducer: the KASAN report above still fires with that commit applied, and is gone with this patch on top. Fix it by discarding the rest of the packet on this path, as suggested by Xin. After the stale-cookie ERROR has sent the association back to COOKIE-WAIT and removed the non-primary transports, the remaining chunks of the packet can only run against the restarted handshake while referencing the removed arrival transport through chunk->transport: besides the last_data_from registration above, sctp_cmd_setup_t2() and the sctp_make_*() reply builders would also copy that pointer into association-lifetime state that sctp_assoc_rm_peer() has already sanitized. Let the peer retransmit them, in line with what sctp_inq_push() does for chunks whose transport was removed before processing.

References

NVD — CVE-2026-98548 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98548
git.kernel.org/stable/c/1cd246b214... WEB
https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2
git.kernel.org/stable/c/4498467a8a... WEB
https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449
git.kernel.org/stable/c/6df536c5ac... WEB
https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4
git.kernel.org/stable/c/854c053c71... WEB
https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2
git.kernel.org/stable/c/965e21ea16... WEB
https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665
git.kernel.org/stable/c/c0af3fd150... WEB
https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a
git.kernel.org/stable/c/d68c9287b3... WEB
https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321
git.kernel.org/stable/c/ec23855274... WEB
https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d

Frequently Asked Questions

What is CVE-2026-98548?
CVE-2026-98548 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98548?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98548?
CVE-2026-98548 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98548?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3mq3-vc9v-9wmc",
  "modified" : "2026-10-18T18:31:53Z",
  "published" : "2026-10-18T18:31:53Z",
  "aliases" : [ "CVE-2026-98548" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: discard the rest of the packet on a stale-cookie error\n\nWhen an association is in COOKIE-ECHOED state and the peer sends a\nbundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary\naddresses, processing the ERROR chunk takes the non-fatal stale-cookie\nretry path sctp_sf_do_5_2_6_stale(), which queues\nSCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.\nsctp_cmd_del_non_primary() removes every non-primary transport -\nincluding the very transport this packet arrived on, which is still\nreferenced by the receive lookup and shared by all chunks of the\npacket via chunk->transport.\n\nsctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from\nthe removed transport, but right afterwards the bundled DATA chunk\nmakes sctp_assoc_bh_rcv() re-register\nasoc->peer.last_data_from = chunk->transport unconditionally, undoing\nthe redirection with the just-removed transport.\n\nOnce the packet is done, the receive reference is dropped and the\ntransport is RCU-freed, while the surviving association keeps the\ndangling last_data_from.  A later FWD-TSN (or the delayed SACK timer)\nmakes sctp_gen_sack() dereference it (->param_flags and friends), and\nsctp_make_sack()/sctp_outq_select_transport() may write to the freed\nobject and link it into the live transport list.  This is a\nuse-after-free triggerable by any malicious SCTP peer (or a local\nunprivileged user acting as one) with no capabilities required:\n\n  BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660\n  Read of size 4 at addr ffff88800e1e356c by task poc/115\n  Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <-\n              sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv\n  Allocated: sctp_transport_new <- sctp_assoc_add_peer <-\n             sctp_process_init (INIT-ACK processing)\n  Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core\n         (call_rcu queued by sctp_transport_put at end of sctp_rcv)\n  The buggy address is located 364 bytes inside of freed 1024-byte\n  region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k\n\nNote that commit 03a9d10ecf71 (\"sctp: drop a chunk if its transport\nwas removed\") only covers the window between the receive lookup and\nthe chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog);\nhere the transport is removed *while* the packet is being processed,\nby an earlier chunk of the same packet, so the drop in sctp_inq_push()\ndoes not reach this path.  Verified with the bundled [ERROR(Stale\nCookie)][DATA] + FWD-TSN reproducer: the KASAN report above still\nfires with that commit applied, and is gone with this patch on top.\n\nFix it by discarding the rest of the packet on this path, as suggested\nby Xin.  After the stale-cookie ERROR has sent the association back to\nCOOKIE-WAIT and removed the non-primary transports, the remaining\nchunks of the packet can only run against the restarted handshake\nwhile referencing the removed arrival transport through\nchunk->transport: besides the last_data_from registration above,\nsctp_cmd_setup_t2() and the sctp_make_*() reply builders would also\ncopy that pointer into association-lifetime state that\nsctp_assoc_rm_peer() has already sanitized.  Let the peer retransmit\nthem, in line with what sctp_inq_push() does for chunks whose\ntransport was removed before processing.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98548"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:06Z"
  }
}