{"id":"AZL-108596","summary":"CVE-2026-98614 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid livelock while updating retransmit path\n\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNCONFIRMED: the state check\nruns before the wraparound test, so the loop cannot observe that it has\ncompleted a full pass.\n\nFix this by considering a transport only when it is not UNCONFIRMED,\nthen checking whether the walk has returned to retran_path. This makes\nthe full-pass termination independent of the transport state while\npreserving the existing fallback selection semantics.\n\nAlso restore the NULL guard around the retran_path assignment. In the\nall-UNCONFIRMED case there is no eligible replacement transport, and\ninstalling NULL would leave later retransmit-path users and the debug\nprint with a NULL path.","modified":"2026-10-19T14:17:05.578416102Z","published":"2026-10-18T16:17:14Z","upstream":["CVE-2026-98614"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98614"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108596.json"}}],"schema_version":"1.9.0"}