{"schema_version":"1.9.0","id":"CVE-2026-63971","published":"2026-07-19T14:55:57.792Z","modified":"2026-08-31T18:26:03.054794236Z","related":["SUSE-SU-2026:23066-1","SUSE-SU-2026:23068-1","SUSE-SU-2026:23193-1","SUSE-SU-2026:23194-1","SUSE-SU-2026:23221-1","SUSE-SU-2026:23231-1","SUSE-SU-2026:23237-1","SUSE-SU-2026:23241-1","SUSE-SU-2026:23244-1","SUSE-SU-2026:3593-1","SUSE-SU-2026:3595-1","SUSE-SU-2026:3602-1","SUSE-SU-2026:3616-1","SUSE-SU-2026:3617-1","SUSE-SU-2026:3790-1","SUSE-SU-2026:3810-1","openSUSE-SU-2026:21555-1"],"summary":"sctp: fix race between sctp_wait_for_connect and peeloff","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix race between sctp_wait_for_connect and peeloff\n\nsctp_wait_for_connect() drops and re-acquires the socket lock while\nwaiting for the association to reach ESTABLISHED state. During this\nwindow, another thread can peeloff the association to a new socket via\ngetsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After\nre-acquiring the old socket lock, sctp_wait_for_connect() returns\nsuccess without noticing the migration — the caller then accesses\nthe association under the wrong lock in sctp_datamsg_from_user().\n\nAdd the same sk != asoc->base.sk check that sctp_wait_for_sndbuf()\nalready has, returning an error if the association was migrated while\nwe slept.","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"668c9beb9020d5834ee9e43c208190a07d2b1928"},{"fixed":"0e0d5bc76fd4267a71334fcc8f1a5fbcf997845d"},{"fixed":"bcfeac79af740735ace44008b4a11b8e5add20f5"},{"fixed":"8e9b56051d24540cfbf39194618708c4a7633549"},{"fixed":"634a9af8a26a84d8b0d7b3b643204b344b42d9fb"},{"fixed":"7d2038d4b80166f7bead8d07eba3b97405816c21"},{"fixed":"68667ee4c7dadf7f63167234e2a1af09b3f7874e"},{"fixed":"6140cfa721451fa6e18e134e709703c2bf34d0fb"},{"fixed":"f14fe6395a8b3d961a61e138ad7b36ba3626dd4e"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63971.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.0"},{"fixed":"5.10.259"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.93"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.35"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.12"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63971.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0e0d5bc76fd4267a71334fcc8f1a5fbcf997845d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6140cfa721451fa6e18e134e709703c2bf34d0fb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/634a9af8a26a84d8b0d7b3b643204b344b42d9fb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/68667ee4c7dadf7f63167234e2a1af09b3f7874e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7d2038d4b80166f7bead8d07eba3b97405816c21"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8e9b56051d24540cfbf39194618708c4a7633549"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bcfeac79af740735ace44008b4a11b8e5add20f5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f14fe6395a8b3d961a61e138ad7b36ba3626dd4e"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63971.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63971"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63971.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}