https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 07:47:00 +0000 https://vulnerability.circl.lu/vuln/cve-2026-98130 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START</p> <p>The SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). The timer can expire and detach between these operations, causing timer_reduce() to rearm the timer without taking the association reference required for the newly armed timer.</p> <p>The timer callback later unconditionally drops its association reference, which can leave the association reference count unbalanced and result in use-after-free during association teardown.</p> <p>Use the return value of timer_reduce() to determine whether the timer was actually armed. Take the association reference only when timer_reduce() successfully starts a new timer, closing the race between checking the timer state and rearming it.</p> <p>This issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero Day Initiative.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START</p> <p>The SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). The timer can expire and detach between these operations, causing timer_reduce() to rearm the timer without taking the association reference required for the newly armed timer.</p> <p>The timer callback later unconditionally drops its association reference, which can leave the association reference count unbalanced and result in use-after-free during association teardown.</p> <p>Use the return value of timer_reduce() to determine whether the timer was actually armed. Take the association reference only when timer_reduce() successfully starts a new timer, closing the race between checking the timer state and rearming it.</p> <p>This issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero Day Initiative.</p> https://vulnerability.circl.lu/vuln/cve-2026-98130