PT-2026-44350 · Linux+1 · Linux Kernel+1
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A use-after-free or type confusion issue exists in the SCTP implementation of the Linux kernel. In the
sctp sendmsg() function, the SCTP SENDALL path iterates through associations using list for each entry safe(), which caches the next entry in the tmp variable. The function calls sctp sendmsg to asoc(), which may drop the socket lock within sctp wait for sndbuf(). While the lock is released, another thread can migrate the cached association to a new endpoint via sctp sock migrate() or free it due to a network ABORT. Because the tmp variable is not revalidated after the lock is re-acquired, the iterator may advance to a stale pointer, leading to a use-after-free if the socket was closed, or type confusion if the association was migrated. The type confusion path can allow a controlled indirect call via the outqueue.sched->init sid pointer.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Use After Free
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel
Rocky Linux