Linux Kernel SCTP: Dangling Pointer via RCV_SHUTDOWN after connect wait
CVE-2026-98846 Published on October 18, 2026
sctp: check RCV_SHUTDOWN after the sendmsg connect wait
In the Linux kernel, the following vulnerability has been resolved:
sctp: check RCV_SHUTDOWN after the sendmsg connect wait
sctp_wait_for_connect() drops the socket lock while it sleeps. An
out-of-the-blue ABORT can then be processed from the socket backlog and
unlink the association. If a concurrent shutdown(fd, SHUT_RD) sets
RCV_SHUTDOWN, the waiter breaks with err == 0 before checking
asoc->base.dead. Its final sctp_association_put() can then free the
association, leaving sctp_sendmsg_to_asoc() to continue with a dangling
pointer.
Check RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc()
before using the association again. The check only accesses the socket,
so it needs no additional association reference. Return the existing
-ESRCH so that sctp_sendmsg() skips freeing a new association that may
already have been destroyed.
Keep sctp_wait_for_connect() unchanged to preserve its behavior for the
connect() caller.
Products Associated with CVE-2026-98846
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 668c9beb9020d5834ee9e43c208190a07d2b1928 and below e8f972b1759d26bbefe4c524caae1ed7c8a593bd is affected.
- Version 668c9beb9020d5834ee9e43c208190a07d2b1928 and below e701345d886e831fb593a0870d69c8c5de6fc938 is affected.
- Version 668c9beb9020d5834ee9e43c208190a07d2b1928 and below 222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669 is affected.
- Version 668c9beb9020d5834ee9e43c208190a07d2b1928 and below 4f1da630d13de0370e2f6361f961f1c8b384af1c is affected.
- Version 4.16 is affected.
- Before 4.16 is unaffected.
- Version 6.12.113, <= 6.12.* is unaffected.
- Version 6.18.56, <= 6.18.* is unaffected.
- Version 7.2.10, <= 7.2.* is unaffected.
- Version 7.3-rc6, <= * is unaffected.