The vulnerability in the Linux kernel SCTP subsystem involves a race condition between sctp_wait_for_connect() and the peeloff operation. sctp_wait_for_connect() temporarily releases the socket lock while waiting for the SCTP association to reach the ESTABLISHED state. If another thread performs a peeloff operation during this window, the association's socket pointer changes. Upon re-acquiring the old socket lock, sctp_wait_for_connect() does not detect this migration and returns success, causing subsequent code to access the association under an incorrect lock. The patch adds a check comparing the socket pointer before and after waiting, returning an error if a migration is detected, preventing incorrect lock usage.

If exploited, this race condition could cause kernel code to access SCTP association data structures under the wrong socket lock, potentially leading to data corruption or instability in the kernel's SCTP networking stack. No known exploits are reported in the wild. The impact is limited to SCTP usage in the Linux kernel and requires concurrent operations involving peeloff and connection establishment.

A fix for this vulnerability has been implemented in the Linux kernel source code. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the Linux kernel vendor advisory or distribution security advisories for the current remediation status and updated kernel versions.