CVE-2026-63971 Details
Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_for_connect() drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the association to a new socket via getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After re-acquiring the old socket lock, sctp_wait_for_connect() returns success without noticing the migration — the caller then accesses the association under the wrong lock in sctp_datamsg_from_user(). Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf() already has, returning an error if the association was migrated while we slept.
A race condition vulnerability has been identified in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. This issue arises in the 'sctp_wait_for_connect' function, which drops and re-acquires the socket lock while waiting for an association to reach the ESTABLISHED state. During this period, another thread can peel off the association to a new socket using the 'getsockopt(SCTP_SOCKOPT_PEELOFF)' option, inadvertently changing the association's socket reference. When the original socket lock is re-acquired, 'sctp_wait_for_connect' erroneously reports success without recognizing the migration. This oversight can lead to the association being accessed under the wrong lock in the 'sctp_datamsg_from_user' function, potentially causing data corruption or other unintended behavior.
Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability. The specific commits that fix this issue can be downloaded as part of the Linux kernel source.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | kernel.org |
| Jul 19, 2026 | New CVE Received | kernel.org |