Executive brief
A race condition vulnerability was identified in the Linux kernel's implementation of the SCTP networking protocol. This flaw could allow a local attacker to cause a system crash or unpredictable behavior by manipulating network connections while they are being established. The issue specifically affects how the system manages locks on network sockets during a 'peeloff' operation.
Technical details
A race condition exists in net/sctp/socket.c within the sctp_wait_for_connect() function. The function drops and re-acquires the socket lock while waiting for an association to reach the ESTABLISHED state. During this period of unlocked execution, another thread can perform a 'peeloff' operation via getsockopt(SCTP_SOCKOPT_PEELOFF), which migrates the association to a new socket and updates asoc->base.sk. Because sctp_wait_for_connect() did not previously verify if the association still belonged to the original socket after re-acquiring the lock, subsequent operations like sctp_datamsg_from_user() would access the association using the incorrect socket lock. This is fixed by adding a check to ensure sk == asoc->base.sk after re-locking.
Affected products
- Linux Linux Kernel 4.16 to 6.13
Timeline
- 2026-05-27: disclosed: Initial patch submitted by Zhenghang Xiao
- 2026-06-19: patched: Patch committed to stable trees by Greg Kroah-Hartman
- 2026-07-19: advisory: CVE-2026-63971 published
References
- https://git.kernel.org/stable/c/0e0d5bc76fd4267a71334fcc8f1a5fbcf997845d
- https://git.kernel.org/stable/c/6140cfa721451fa6e18e134e709703c2bf34d0fb
- https://git.kernel.org/stable/c/634a9af8a26a84d8b0d7b3b643204b344b42d9fb
- https://git.kernel.org/stable/c/68667ee4c7dadf7f63167234e2a1af09b3f7874e
- https://git.kernel.org/stable/c/7d2038d4b80166f7bead8d07eba3b97405816c21
- https://git.kernel.org/stable/c/8e9b56051d24540cfbf39194618708c4a7633549
- https://git.kernel.org/stable/c/bcfeac79af740735ace44008b4a11b8e5add20f5