In the Linux kernel, the following vulnerability has been resolved:

sctp: check RCV SHUTDOWN after the sendmsg connect wait

sctp wait for connect() drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurrent shutdown(fd, SHUT RD) sets RCV SHUTDOWN, the waiter breaks with err == 0 before checking asoc->base.dead. Its final sctp association put() can then free the association, leaving sctp sendmsg to asoc() to continue with a dangling pointer.

Check RCV SHUTDOWN along with the wait error in sctp sendmsg to asoc() before using the association again. The check only accesses the socket, so it needs no additional association reference. Return the existing -ESRCH so that sctp sendmsg() skips freeing a new association that may already have been destroyed.

Keep sctp wait for connect() unchanged to preserve its behavior for the connect() caller.