All vulnerabilities
CVE-2026-98846

Linux: sctp: check RCV_SHUTDOWN after the sendmsg connect wait

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1bef1944ef15a40797305bf916827b04df6307caAlso 222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669, 4f1da630d13de0370e2f6361f961f1c8b384af1cCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1bef1944ef15a40797305bf916827b04df6307caLinuxCVE List
  • 222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669LinuxCVE List
  • 4f1da630d13de0370e2f6361f961f1c8b384af1cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: check RCV_SHUTDOWN after the sendmsg connect wait

sctp_wait_for_connect() drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurrent shutdown(fd, SHUT_RD) sets RCV_SHUTDOWN, the waiter breaks with err == 0 before checking asoc->base.dead. Its final sctp_association_put() can then free the association, leaving sctp_sendmsg_to_asoc() to continue with a dangling pointer.

Check RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc() before using the association again. The check only accesses the socket, so it needs no additional association reference. Return the existing -ESRCH so that sctp_sendmsg() skips freeing a new association that may already have been destroyed.

Keep sctp_wait_for_connect() unchanged to preserve its behavior for the connect() caller.

Text from CVE List

Affected versions 12

  • Linuxaffected: 668c9beb9020d5834ee9e43c208190a07d2b1928 before 1bef1944ef15a40797305bf916827b04df6307caCVE List
  • Linuxaffected: 668c9beb9020d5834ee9e43c208190a07d2b1928 before e8f972b1759d26bbefe4c524caae1ed7c8a593bdCVE List
  • Linuxaffected: 668c9beb9020d5834ee9e43c208190a07d2b1928 before e701345d886e831fb593a0870d69c8c5de6fc938CVE List
  • Linuxaffected: 668c9beb9020d5834ee9e43c208190a07d2b1928 before 222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669CVE List
  • Linuxaffected: 668c9beb9020d5834ee9e43c208190a07d2b1928 before 4f1da630d13de0370e2f6361f961f1c8b384af1cCVE List
  • Linuxaffected: 4.16CVE List
  • Linuxunaffected: all versions before 4.16CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5