CVE-2026-63971

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists between the sctp wait for connect() function and the peeloff process. The sctp wait for connect() function releases and subsequently re-acquires the socket lock while waiting for an association to reach the ESTABLISHED state. During this interval, a separate thread can migrate the association to a new socket using the getsockopt(SCTP SOCKOPT PEELOFF) endpoint, which modifies asoc->base.sk. Upon re-acquiring the lock, sctp wait for connect() may return success without detecting this migration, leading the caller to access the association using an incorrect lock within the sctp datamsg from user() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.