In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_for_connect()… (CVE-2026-63971)

The Linux kernel SCTP subsystem had a race condition between sctp_wait_for_connect() and the peeloff operation. sctp_wait_for_connect() releases and re-acquires the socket lock while waiting for the SCTP association to reach the ESTABLISHED state. If another thread performs a peeloff via getsockopt(SCTP_SOCKOPT_PEELOFF) during this window, the association's socket pointer changes. However, sctp_wait_for_connect() does not detect this migration and returns success, causing subsequent code to access the association under an incorrect socket lock. The vulnerability was fixed by adding a check to verify that the socket pointer has not changed during the wait, returning an error if it has.

This race condition can lead to incorrect locking and potentially allow unauthorized or unsafe access to SCTP association data structures. The CVSS score of 7.8 indicates high severity with impacts on confidentiality, integrity, and availability. Exploitation could lead to privilege escalation or denial of service due to corrupted state or improper synchronization.

A fix has been implemented in the Linux kernel to address this race condition by adding a socket pointer check in sctp_wait_for_connect(). Users should apply the official kernel updates that include this patch. Since no explicit patch links or affected versions are provided, consult the Linux kernel vendor advisories or distribution security updates for the fixed versions. No additional mitigations are indicated.