CVE-2026-98548: sctp: discard the rest of the packet on a stale-cookie error

In the Linux kernel, the following vulnerability has been resolved:

sctp: discard the rest of the packet on a stale-cookie error

When an association is in COOKIE-ECHOED state and the peer sends a bundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary addresses, processing the ERROR chunk takes the non-fatal stale-cookie retry path sctpsfdo526stale(), which queues SCTPCMDDELNONPRIMARY while keeping the association alive. sctpcmddelnonprimary() removes every non-primary transport - including the very transport this packet arrived on, which is still referenced by the receive lookup and shared by all chunks of the packet via chunk->transport.

sctpassocrmpeer() does redirect asoc->peer.lastdatafrom away from the removed transport, but right afterwards the bundled DATA chunk makes sctpassocbhrcv() re-register asoc->peer.lastdatafrom = chunk->transport unconditionally, undoing the redirection with the just-removed transport.

Once the packet is done, the receive reference is dropped and the transport is RCU-freed, while the surviving association keeps the dangling lastdatafrom. A later FWD-TSN (or the delayed SACK timer) makes sctpgensack() dereference it (->paramflags and friends), and sctpmakesack()/sctpoutqselecttransport() may write to the freed object and link it into the live transport list. This is a use-after-free triggerable by any malicious SCTP peer (or a local unprivileged user acting as one) with no capabilities required:

BUG: KASAN: slab-use-after-free in sctpdosm+0x498a/0x5660 Read of size 4 at addr ffff88800e1e356c by task poc/115 Call Trace: sctpdosm <- sctpassocbhrcv <- sctpinqpush <- sctprcv <- ipprotocoldeliverrcu <- iprcv Allocated: sctptransportnew <- sctpassocaddpeer <- sctpprocessinit (INIT-ACK processing) Freed: kfree <- sctptransportdestroyrcu <- rcucore (callrcu queued by sctptransportput at end of sctprcv) The buggy address is located 364 bytes inside of freed 1024-byte region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k

Note that commit 03a9d10ecf71 ("sctp: drop a chunk if its transport was removed") only covers the window between the receive lookup and the chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog); here the transport is removed while the packet is being processed, by an earlier chunk of the same packet, so the drop in sctpinqpush() does not reach this path. Verified with the bundled [ERROR(Stale Cookie)][DATA] + FWD-TSN reproducer: the KASAN report above still fires with that commit applied, and is gone with this patch on top.

Fix it by discarding the rest of the packet on this path, as suggested by Xin. After the stale-cookie ERROR has sent the association back to COOKIE-WAIT and removed the non-primary transports, the remaining chunks of the packet can only run against the restarted handshake while referencing the removed arrival transport through chunk->transport: besides the lastdatafrom registration above, sctpcmdsetupt2() and the sctpmake() reply builders would also copy that pointer into association-lifetime state that sctpassocrmpeer() has already sanitized. Let the peer retransmit them, in line with what sctpinqpush() does for chunks whose transport was removed before processing.