CVE-2026-46227

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with

list_for_each_entry_safe(), which caches the next entry in @tmp before

the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may

drop the socket lock inside sctp_wait_for_sndbuf().

While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the

association cached in @tmp, migrating it to a new endpoint via

sctp_sock_migrate() (list_del_init() + list_add_tail() to

newep->asocs), and optionally close the new socket which frees the

association via kfree_rcu(). The cached @tmp can also be freed by a

network ABORT for that association, processed in softirq while the

lock is dropped.

sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock

via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing

revalidates @tmp. After a successful ret

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References