CVE-2026-46227: Linux SCTP Race Condition Use-After-Free Privilege Escalation

Technical summary

The SCTP_SENDALL code path in sctp_sendmsg() uses list_for_each_entry_safe() to iterate associations on an endpoint. This macro caches the next entry (@tmp) before entering the loop body. The loop calls sctp_sendmsg_to_asoc(), which may drop the socket lock via sctp_wait_for_sndbuf(). While unlocked, concurrent operations can: (1) SCTP_SOCKOPT_PEELOFF an association, migrating it to a new endpoint through sctp_sock_migrate() (list_del_init() followed by list_add_tail()), then close the new socket triggering kfree_rcu() on the association; or (2) network ABORT messages processed in softirq can free the association. The sctp_wait_for_sndbuf() revalidates the current entry (@asoc) via sk and dead checks but does not revalidate the cached @tmp. After return, the iterator resumes from @tmp—now a stale pointer—causing either use-after-free or type confusion where @newep->asocs is misinterpreted as a struct sctp_association, enabling controlled indirect calls through outqueue.sched->init_sid. The fix re-derives @tmp from @asoc post-operation to ensure validity.

Business impact

This vulnerability affects any Linux-based system handling SCTP traffic and permits local privilege escalation. An attacker with local access but no special capabilities (CapEff=0) can trigger memory corruption and execute arbitrary kernel code, compromising system confidentiality, integrity, and availability. This is particularly significant for containerized environments, shared hosting, and systems running SCTP-dependent applications (certain telecom, RTC, and clustering software). Exploitation does not require network access or elevated privileges, making it broadly exploitable by any local user.

Affected systems

All Linux kernel versions containing the SCTP subsystem are affected. This includes mainstream distributions (Ubuntu, Red Hat, Debian, SUSE) and embedded systems using the mainline or stable kernel branches. Systems must have SCTP enabled in the kernel configuration; check via 'cat /proc/net/sctp/snmp' or 'lsmod | grep sctp'. Specific patched versions vary by distribution; consult vendor advisories for your kernel series.

Exploitability

Exploitability is rated HIGH. The vulnerability is locally exploitable without elevated privileges (CapEff=0) and requires only multi-threaded execution capabilities and knowledge of SCTP message handling. No exploit is currently known to be widely available, but the attack vector is straightforward: trigger SCTP_SENDALL via one thread while concurrently performing SCTP_SOCKOPT_PEELOFF or awaiting network ABORT on another. The type-confusion path yielding an indirect function pointer call (outqueue.sched->init_sid) further reduces exploitation complexity once the race is reliable.

Remediation

Apply the Linux kernel patch that re-derives @tmp from @asoc after sctp_sendmsg_to_asoc() returns, ensuring the cached iterator is revalidated post-unlock. This fix is relatively lightweight and does not alter the SCTP API. All affected Linux distributions must backport this change to their stable kernel series. Users unable to patch immediately should disable SCTP in the kernel config if not required, or restrict local access to untrusted users.

Patch guidance

Patch availability varies by Linux distribution. Check your vendor's security advisory page (Red Hat, Ubuntu, SUSE, Debian) for CVE-2026-46227 to obtain the specific kernel version and errata ID. The upstream fix focuses on re-validation of the list iterator; verify the patch against the vendor advisory to confirm it includes the @tmp re-derive logic. Apply patches during a maintenance window; kernel updates typically require a reboot to take effect. For enterprises, coordinate with change management and validate in a test environment before production deployment.

Detection guidance

Kernel panic logs, ASAN/KASAN reports, or system core dumps may reveal use-after-free or type-confusion signatures near sctp_sendmsg() or the SCTP outqueue sched operations. Monitor for: (1) 'general protection faults' or 'BUG: unable to handle page fault' in SCTP code, (2) kmemleak or automated sanitizer reports in SCTP association objects, (3) unexplained kernel crashes or reboots correlated with multi-threaded SCTP client activity. Userspace monitoring of SCTP socket options (via netlink auditing or seccomp tracing) may detect abnormal SCTP_SOCKOPT_PEELOFF or SCTP_SENDALL usage patterns. At scale, correlate kernel logs across systems for timing anomalies coinciding with local process activity.

Why prioritize this

Assign this HIGH priority. The CVSS 3.1 score of 7.8 reflects local privilege escalation leading to complete system compromise (C:H I:H A:H). Although not yet in the KEV catalog, the attack vector is low complexity and requires only standard user privileges, meaning it affects most deployments. SCTP, while less common than TCP/UDP, is critical in telecom and real-time communication stacks; systems relying on SCTP must patch urgently. The multi-threaded race condition is readily triggered in modern containerized and multi-user environments.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector LOCAL (LAN only, no network attack), Attack Complexity LOW (race condition is triggerable without special conditions), Privileges Required LOW (user-level CapEff=0 sufficient), User Interaction NONE, Scope UNCHANGED (no privilege domain crossing required for impact scope), and full impact on Confidentiality, Integrity, and Availability. The score appropriately penalizes the local-only vector but credits the lack of complexity, low privilege bar, and complete compromise potential. Not yet flagged for active exploitation (KEV=false), but the exploit path is relatively accessible to threat actors with local access.

Frequently asked questions