Junglewise Threat Intelligence

CVE-2026-46227: Linux Kernel use-after-free in SCTP_SENDALL processing

CVE-2026-46227 · Severity: info · Published 2026-05-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's implementation of the SCTP protocol, which is used for transporting data over networks. A local attacker could exploit this flaw to cause a system crash or potentially execute unauthorized code by triggering a specific sequence of network operations. This issue primarily affects the stability and security of systems using SCTP for specialized communication.

Technical details

A race condition exists in net/sctp/socket.c within the sctp_sendmsg() function when using the SCTP_SENDALL flag. The code iterates through associations using list_for_each_entry_safe(), which caches the next pointer. However, sctp_sendmsg_to_asoc() may drop the socket lock, allowing another thread to 'peel off' or free the cached association. This leads to a use-after-free or type confusion when the iterator advances to the stale pointer. An attacker can leverage the type confusion to achieve a controlled indirect call via the outqueue.sched->init_sid pointer. The fix involves re-validating and re-deriving the list cursor after the lock is re-acquired.

Affected products

  • Linux Linux Kernel Introduced in 4910280503f3; fixed in various stable branches including 6.1, 6.6, 6.8, 6.9

Timeline

  • 2026-05-07: other: Patch authored
  • 2026-05-28: disclosed: CVE published

References

Related threats