In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV_SHUTDOWN after the sendmsg connect wait sctp_wait_for_connect()… (CVE-2026-98846)

The vulnerability in the Linux kernel SCTP (Stream Control Transmission Protocol) code arises because sctp_wait_for_connect() releases the socket lock while sleeping, which allows an out-of-the-blue ABORT message to unlink the association concurrently. If a shutdown(fd, SHUT_RD) call sets the RCV_SHUTDOWN flag concurrently, the waiter can exit with no error before verifying if the association is dead. This leads to sctp_association_put() freeing the association, while sctp_sendmsg_to_asoc() continues to use a dangling pointer. The fix involves checking the RCV_SHUTDOWN flag along with the wait error in sctp_sendmsg_to_asoc() before reusing the association, preventing use-after-free without changing sctp_wait_for_connect() behavior.

This vulnerability can cause use-after-free conditions in the SCTP socket handling code, potentially leading to kernel memory corruption or crashes. However, no known exploits in the wild have been reported. The impact is limited to SCTP socket operations in the Linux kernel.

A fix has been implemented in the Linux kernel to check the RCV_SHUTDOWN flag appropriately in sctp_sendmsg_to_asoc(), preventing use-after-free. Users should apply the official kernel update that includes this fix once available. No additional mitigation is required as the fix preserves existing behavior for connect() callers.