CVE-2026-46227

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock inside sctp_wait_for_sndbuf(). While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the association cached in @tmp, migrating it to a new endpoint via sctp_sock_migrate() (list_del_init() + list_add_tail() to newep->...

Affected product and versions

Product

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support

Affected versions

>= 4910280503f3af2857d5aa77e35b22d93a8960a8 < f3a3f0b406b4b7eb3cea35a23fa2bf170848b104, >= 4910280503f3af2857d5aa77e35b22d93a8960a8 < 0dbc8cde64280fc37cdd678cced34eaf96cfb197, >= 4910280503f3af2857d5aa77e35b22d93a8960a8 < 0c7b55974f97b78d1109025eadf084e74cbf330f, >= 4910280503f3af2857d5aa77e35b22d93a8960a8 < 1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078, >= 4910280503f3af2857d5aa77e35b22d93a8960a8 < 6187a172d6ed57d6b2c327836e4407c6456e639d, >= 4910280503f3af2857d5aa77e35b22d93a8960a8 < c9dadb31f36045a8cb65df4bd75e7237ef21a4b5, >= 4910280503f3af2857d5aa77e35b22d93a8960a8 < bf0f40d8107e2ce827521968dc6926f3e13728ae, >= 4910280503f3af2857d5aa77e35b22d93a8960a8 < abb5f36771cc4c05899b34000829a787572a8817, >= 4.17, >= 4.17 < 5.10.258, >= 5.11 < 5.15.209, >= 5.16 < 6.1.175, >= 6.2 < 6.6.140, >= 6.7 < 6.12.90, >= 6.13 < 6.18.32, >= 6.19 < 7.0.9, 7.1

Fixed versions

5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.90, 6.18.32, 7.0.9

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-367, CWE-416