CVE-2026-63971: high-severity vulnerability in Linux
sctp: fix race between sctp_wait_for_connect and peeloff
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8epss 0.1%
exploitation probability
0.1%top 97% of all CVEs
observed exploitation
nono source reports it
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix race between sctp_wait_for_connect and peeloff
sctp_wait_for_connect() drops and re-acquires the socket lock while
waiting for the association to reach ESTABLISHED state. During this
window, another thread can peeloff the association to a new socket via
getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After
re-acquiring the old socket lock, sctp_wait_for_connect() returns
success without noticing the migration — the caller then accesses
the association under the wrong lock in sctp_datamsg_from_user().
Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf()
already has, returning an error if the association was migrated while
we slept.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Linux · LinuxRelated CVEs — Linux
In the same product, most dangerous first.
CVE-2026-31431HIGHcrypto: algif_aead - Revert to operating out-of-placeEPSS 98.1%KEVCVE-2026-46300HIGHnet: skbuff: preserve shared-frag marker during coalescingEPSS 15.7%KEVCVE-2024-53197HIGHALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devicesEPSS 4.1%KEVCVE-2024-53104HIGHmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatEPSS 3.4%KEVCVE-2025-39682CRITICALtls: fix handling of zero-length records on the rx_listEPSS 3.3%KEVCVE-2024-36971HIGHnet: fix __dst_negative_advice() raceEPSS 2.7%KEV
References
https://git.kernel.org/stable/c/0e0d5bc76fd4267a71334fcc8f1a5fbcf997845dhttps://git.kernel.org/stable/c/6140cfa721451fa6e18e134e709703c2bf34d0fbhttps://git.kernel.org/stable/c/634a9af8a26a84d8b0d7b3b643204b344b42d9fbhttps://git.kernel.org/stable/c/68667ee4c7dadf7f63167234e2a1af09b3f7874ehttps://git.kernel.org/stable/c/7d2038d4b80166f7bead8d07eba3b97405816c21https://git.kernel.org/stable/c/8e9b56051d24540cfbf39194618708c4a7633549https://git.kernel.org/stable/c/bcfeac79af740735ace44008b4a11b8e5add20f5https://git.kernel.org/stable/c/f14fe6395a8b3d961a61e138ad7b36ba3626dd4e