In the Linux kernel, the following vulnerability has been resolved:
sctp: detect and prevent references to a freed transport in sendmsg
sctp_sendmsg() re-uses associations and transports when possible by doing a lookup based on the socket endpoint and the message destination address, and then sctp_sendmsg_to_asoc() sets the selected transport in all the message chunks to be sent.
There's a possible race condition if another thread triggers the removal of that selected transport, for instance, by explicitly unbinding an address with setsockopt(SCTP_SOCKOPT_BINDX_REM), after the chunks have been set up and before the message is sent. This can happen if the send buffer is full, during the period when the sender thread temporarily releases the socket lock in sctp_wait_for_sndbuf().
This causes the access to the transport data in sctp_outq_select_transport(), when the association outqueue is flushed, to result in a use-after-free read.
This change avoids this scenario by having sctp_transport_free() signal the freeing of the transport, tagging it as "dead". In order to do this, the patch restores the "dead" bit in struct sctp_transport, which was removed in commit 47faa1e4c50e ("sctp: remove the dead field of sctp_transport").
Then, in the scenario where the sender thread has released the socket lock in sctp_wait_for_sndbuf(), the bit is checked again after re-acquiring the socket lock to detect the deletion. This is done while holding a reference to the transport to prevent it from being freed in the process.
If the transport was deleted while the socket lock was relinquished, sctp_sendmsg_to_asoc() will return -EAGAIN to let userspace retry the send.
The bug was found by a private syzbot instance (see the error report [1] and the C reproducer that triggers it [2]).
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.15.184-125.190Upgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.237-230.949Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade kernel-toolsUpgrade kernel-develUpgrade perf | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-libbpfUpgrade kernel-develUpgrade kernel-livepatch-6.1.140-154.222Upgrade kernel6.12Upgrade python3-perf6.12-debuginfoUpgrade kernel-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-livepatch-6.12.25-32.101Upgrade perf6.12-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernelUpgrade python3-perf6.12Upgrade kernel-libbpf-staticUpgrade perfUpgrade kernel-libbpf-develUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade perf6.12Upgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-modules-extra-commonUpgrade kernel-libbpf-debuginfoUpgrade bpftool-debuginfo | Aug 5, 2025 | May 1, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | May 5, 2025 | May 1, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade bpftool | Oct 14, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade python3-perf | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade bpftoolUpgrade kernelUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libs | Oct 24, 2025 | Sep 9, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Jul 17, 2025 | May 1, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 9, 2025 | May 1, 2025 |
| Suse | — | Upgrade reiserfs-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-debugUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade dtb-exynosUpgrade dtb-renesasUpgrade kernel-default-optionalUpgrade kernel-default-baseUpgrade kernel-default-vdsoUpgrade kernel-defaultUpgrade dtb-alteraUpgrade dtb-armUpgrade dtb-lgUpgrade kernel-64kb-extraUpgrade dtb-amazonUpgrade dtb-mediatekUpgrade kernel-source-azureUpgrade cluster-md-kmp-64kbUpgrade dtb-amdUpgrade ocfs2-kmp-defaultUpgrade dtb-sprdUpgrade dlm-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-develUpgrade kernel-default-develUpgrade gfs2-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-64kb-develUpgrade dtb-allwinnerUpgrade dtb-caviumUpgrade kernel-symsUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-64kbUpgrade kernel-rt-develUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-64kbUpgrade kernel-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-azure-optionalUpgrade kernel-debug-develUpgrade gfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-docs-htmlUpgrade dtb-freescaleUpgrade kselftests-kmp-azureUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azureUpgrade dtb-qcomUpgrade kernel-docsUpgrade gfs2-kmp-rtUpgrade dtb-apmUpgrade kernel-kvmsmallUpgrade kernel-rt_debug-develUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-rt-extraUpgrade kernel-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatchUpgrade kernel-macrosUpgrade kernel-source-vanillaUpgrade kernel-obs-buildUpgrade reiserfs-kmp-rtUpgrade dtb-appleUpgrade dtb-amlogicUpgrade kernel-syms-azureUpgrade dlm-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-azure-vdsoUpgrade kernel-sourceUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade kernel-default-extraUpgrade kernel-default-base-rebuildUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-defaultUpgrade dtb-nvidiaUpgrade dtb-marvellUpgrade cluster-md-kmp-azureUpgrade kernel-source-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-defaultUpgrade dtb-socionextUpgrade ocfs2-kmp-rtUpgrade kernel-obs-qaUpgrade dtb-broadcomUpgrade kernel-devel-azureUpgrade kernel-azure-extra | Dec 5, 2025 | Jun 16, 2025 |
| Ubuntu | — | Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-5.15.0-1041-nvidia-tegraUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-1085-oracleUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-5.15.0-1084-kvmUpgrade linux-image-ibmUpgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-1030-nvidia-tegra-igx-rtUpgrade linux-image-azure-fips-5.15Upgrade linux-image-kvm-5.15Upgrade linux-image-raspi-5.15Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-gke-6.8Upgrade linux-image-raspiUpgrade linux-image-aws-6.8Upgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1041-nvidia-tegra-rtUpgrade linux-image-5.15.0-144-genericUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-aws-lts-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-oem-20.04cUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-5.15.0-1080-ibmUpgrade linux-image-genericUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1052-xilinx-zynqmpUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-lowlatency-64kUpgrade linux-image-ibm-classicUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-azure-fips-6.8Upgrade linux-image-xilinxUpgrade linux-image-5.15.0-1083-intel-iotgUpgrade linux-image-azure-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-144-lowlatency-64kUpgrade linux-image-oracle-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-generic-64kUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-144-fipsUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-gcp-fipsUpgrade linux-image-virtual-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-144-generic-lpaeUpgrade linux-image-gke-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-realtime-5.15Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-5.15.0-144-lowlatencyUpgrade linux-image-oracle-5.15Upgrade linux-image-5.15.0-1088-aws-fipsUpgrade linux-image-5.15.0-1082-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-aws-fips-5.15Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-gkeopUpgrade linux-image-nvidia-5.15Upgrade linux-image-generic-64k-5.15Upgrade linux-image-gkeop-6.8Upgrade linux-image-5.15.0-1088-awsUpgrade linux-image-5.15.0-1088-aws-64kUpgrade linux-image-5.15.0-1083-raspiUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-raspi-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-azureUpgrade linux-image-azure-fdeUpgrade linux-image-azure-lts-22.04Upgrade linux-image-azure-5.15Upgrade linux-image-gcpUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-tegraUpgrade linux-image-nvidiaUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-fipsUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-intelUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-ibm-5.15Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-generic-5.15Upgrade linux-image-azure-cvmUpgrade linux-image-aws-5.15Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-oem-20.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-aws-fipsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-20.04dUpgrade linux-image-lowlatency-5.15Upgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-5.15.0-1094-azure-fipsUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-5.15.0-1070-gkeopUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-awsUpgrade linux-image-oem-22.04dUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-oem-22.04bUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-fips-5.15Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-5.15.0-1081-intel-iot-realtimeUpgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-gkeop-5.15Upgrade linux-image-gkeUpgrade linux-image-gcp-5.15Upgrade linux-image-5.15.0-1087-gcp-fipsUpgrade linux-image-realtimeUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-aws-64k-5.15Upgrade linux-image-aws-64kUpgrade linux-image-5.15.0-1087-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-5.15.0-1030-nvidia-tegra-igxUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-oracleUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-virtual-5.15Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-5.15.0-144-generic-64kUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-5.15.0-1088-realtimeUpgrade linux-image-virtualUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-kvmUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-5.15.0-1094-azureUpgrade linux-image-5.15.0-1085-gkeUpgrade linux-image-5.15.0-1082-nvidia-lowlatency | Jun 26, 2025 | May 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub