{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.90-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL  The SCTP_SENDALL path in sctp_sendmsg() iterates ep-\u003easocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs.  The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock inside sctp_wait_for_sndbuf().  While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the association cached in @tmp, migrating it to a new endpoint via sctp_sock_migrate() (list_del_init() + list_add_tail() to newep-\u003easocs), and optionally close the new socket which frees the association via kfree_rcu().  The cached @tmp can also be freed by a network ABORT for that association, processed in softirq while the lock is dropped.  sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock via the \"sk != asoc-\u003ebase.sk\" and \"asoc-\u003ebase.dead\" checks, but nothing revalidates @tmp.  After a successful return, the iterator advances to the stale @tmp, yielding either a use-after-free (if the peeled socket was closed) or a list-walk onto the new endpoint's list head (type confusion of \u0026newep-\u003easocs as a struct sctp_association *).  Both are reachable from CapEff=0; the type-confusion path gives controlled indirect call via the outqueue.sched-\u003einit_sid pointer.  Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc() returns.  @asoc is known to still be on ep-\u003easocs at that point: the only callers that list_del an association from ep-\u003easocs are sctp_association_free() (which sets asoc-\u003ebase.dead) and sctp_assoc_migrate() (which changes asoc-\u003ebase.sk), and sctp_wait_for_sndbuf() checks both under the lock before any successful return; a tripped check propagates as err \u003c 0 and the loop bails before the re-derive.  The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so the @tmp cached by list_for_each_entry_safe() still covers the lock-held free that ba59fb027307 (\"sctp: walk the list of asoc safely\") was added for.",
  "id": "DEBIAN-CVE-2026-46227",
  "modified": "2026-09-14T16:47:31.984530265Z",
  "published": "2026-05-28T10:16:38.317Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-46227"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-46227"
  ]
}