Executive brief
A vulnerability was identified in the Linux kernel's implementation of the SCTP protocol, which is used for transporting data over networks. A local attacker could exploit this flaw to cause a system crash or potentially execute unauthorized code by triggering a specific sequence of network operations. This issue primarily affects the stability and security of systems using SCTP for specialized communication.
Technical details
A race condition exists in net/sctp/socket.c within the sctp_sendmsg() function when using the SCTP_SENDALL flag. The code iterates through associations using list_for_each_entry_safe(), which caches the next pointer. However, sctp_sendmsg_to_asoc() may drop the socket lock, allowing another thread to 'peel off' or free the cached association. This leads to a use-after-free or type confusion when the iterator advances to the stale pointer. An attacker can leverage the type confusion to achieve a controlled indirect call via the outqueue.sched->init_sid pointer. The fix involves re-validating and re-deriving the list cursor after the lock is re-acquired.
Affected products
- Linux Linux Kernel Introduced in 4910280503f3; fixed in various stable branches including 6.1, 6.6, 6.8, 6.9
Timeline
- 2026-05-07: other: Patch authored
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078
- https://git.kernel.org/stable/c/6187a172d6ed57d6b2c327836e4407c6456e639d
- https://git.kernel.org/stable/c/abb5f36771cc4c05899b34000829a787572a8817
- https://git.kernel.org/stable/c/bf0f40d8107e2ce827521968dc6926f3e13728ae
- https://git.kernel.org/stable/c/c9dadb31f36045a8cb65df4bd75e7237ef21a4b5