CVE-2026-46227

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free or type confusion issue exists in the SCTP implementation of the Linux kernel. In the sctp sendmsg() function, the SCTP SENDALL path iterates through associations using list for each entry safe(), which caches the next entry in the tmp variable. The function calls sctp sendmsg to asoc(), which may drop the socket lock within sctp wait for sndbuf(). While the lock is released, another thread can migrate the cached association to a new endpoint via sctp sock migrate() or free it due to a network ABORT. Because the tmp variable is not revalidated after the lock is re-acquired, the iterator may advance to a stale pointer, leading to a use-after-free if the socket was closed, or type confusion if the association was migrated. The type confusion path can allow a controlled indirect call via the outqueue.sched->init sid pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.