CVE-2026-46227 is a vulnerability in the Linux kernel SCTP implementation where the SCTP_SENDALL path in sctp_sendmsg() uses list_for_each_entry_safe() to iterate associations, caching the next entry before the loop body. The loop body calls sctp_sendmsg_to_asoc(), which may drop the socket lock, allowing another thread to modify or free the cached association entry. While the current association is revalidated after re-locking, the cached next entry (@tmp) is not, leading to a use-after-free or type confusion when the iterator advances. This can cause memory corruption or controlled indirect calls. The fix involves re-deriving the cached next entry after the call to sctp_sendmsg_to_asoc() to ensure it remains valid. Red Hat has issued a kernel update for RHEL 10 to address this vulnerability.

Successful exploitation can lead to use-after-free and type confusion in kernel memory, potentially allowing an attacker with local privileges to execute arbitrary code or cause denial of service by crashing the kernel. The CVSS vector indicates local attack vector with low complexity and no user interaction, with high impact on confidentiality, integrity, and availability.

A security update fixing this vulnerability is available from Red Hat for Red Hat Enterprise Linux 10. Users should apply the kernel update (e.g., kernel-6.12.0-211.32.1.el10_2 and related packages) and reboot the system to ensure the fix takes effect. Patch status is confirmed by the vendor advisory. No additional mitigations are specified beyond applying the official update.