Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
Linux Kernel SCTP Connection Race Fix
published 3 months ago
Summary
A security issue has been fixed in the Linux kernel's SCTP (Stream Control Transmission Protocol) connection handling. This issue could have allowed an attacker to manipulate SCTP connections, potentially causing data corruption or system crashes. To address this, update your Linux kernel to the latest version.
What to do
- Update linux kernel to version 7.0.12.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Linux | linux | kernel |
>= 6.19.0, < 7.0.12 Fix: upgrade to 7.0.12
|
Original advisory text
sctp: fix race between sctp_wait_for_connect and peeloff
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix race between sctp_wait_for_connect and peeloff
sctp_wait_for_connect() drops and re-acquires the socket lock while
waiting for the association to reach ESTABLISHED state. During this
window, another thread can peeloff the association to a new socket via
getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After
re-acquiring the old socket lock, sctp_wait_for_connect() returns
success without noticing the migration — the caller then accesses
the association under the wrong lock in sctp_datamsg_from_user().
Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf()
already has, returning an error if the association was migrated while
we slept.
sctp: fix race between sctp_wait_for_connect and peeloff
sctp_wait_for_connect() drops and re-acquires the socket lock while
waiting for the association to reach ESTABLISHED state. During this
window, another thread can peeloff the association to a new socket via
getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After
re-acquiring the old socket lock, sctp_wait_for_connect() returns
success without noticing the migration — the caller then accesses
the association under the wrong lock in sctp_datamsg_from_user().
Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf()
already has, returning an error if the association was migrated while
we slept.
References
- https://git.kernel.org/stable/c/0e0d5bc76fd4267a71334fcc8f1a5fbcf997845d URL
- https://git.kernel.org/stable/c/6140cfa721451fa6e18e134e709703c2bf34d0fb URL
- https://git.kernel.org/stable/c/634a9af8a26a84d8b0d7b3b643204b344b42d9fb URL
- https://git.kernel.org/stable/c/68667ee4c7dadf7f63167234e2a1af09b3f7874e URL
- https://git.kernel.org/stable/c/7d2038d4b80166f7bead8d07eba3b97405816c21 URL
- https://git.kernel.org/stable/c/8e9b56051d24540cfbf39194618708c4a7633549 URL
- https://git.kernel.org/stable/c/bcfeac79af740735ace44008b4a11b8e5add20f5 URL
- https://git.kernel.org/stable/c/f14fe6395a8b3d961a61e138ad7b36ba3626dd4e URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63971... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63971 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published19 Jul 2026
Updated1 Aug 2026
First seen1 Aug 2026
Track software like this
Free during beta