Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-63971

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_for_connect() drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the association to a new socket via getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After re-acquiring the old socket lock, sctp_wait_for_connect() returns success without noticing the migrati
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:7db56e9939565fd286e4fbd18e3b8af75e47c423949389cec68e8c7bd864f5b1
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/sctp/socket.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrE…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sctp/socket.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0e0d5bc76fd4267a71334fcc8f1a5fbcf997845d","status":"affected","version":"668c9beb9020d5834ee9e43c208190a07d2b1928","versionType":"git"},{"lessThan":"bcfeac79af740735ace44008b4a11b8e5add20f5","status":"affected","version":"668c9beb9020d5834ee9e43c208190a07d2b1928","versionType":"git"},{"lessThan":"8e9b56051d24540cfbf39194618708c4a7633549","status":"affected","version":"668c9beb9020d5834ee9e43c2081…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["net/sctp/socket.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrE…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sctp/socket.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0e0d5bc76fd4267a71334fcc8f1a5fbcf997845d","status":"affected","version":"668c9beb9020d5834ee9e43c208190a07d2b1928","versionType":"git"},{"lessThan":"bcfeac79af740735ace44008b4a11b8e5add20f5","status":"affected","version":"668c9beb9020d5834ee9e43c208190a07d2b1928","versionType":"git"},{"lessThan":"8e9b56051d24540cfbf39194618708c4a7633549","status":"affected","version":"668c9beb9020d5834ee9e43c2081…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/0e0d5bc76fd4267a71334fcc8f1a5fbcf997845d"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/6140cfa721451fa6e18e134e709703c2bf34d0fb"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/634a9af8a26a84d8b0d7b3b643204b344b42d9fb"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/68667ee4c7dadf7f63167234e2a1af09b3f7874e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/7d2038d4b80166f7bead8d07eba3b97405816c21"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/8e9b56051d24540cfbf39194618708c4a7633549"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/bcfeac79af740735ace44008b4a11b8e5add20f5"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/f14fe6395a8b3d961a61e138ad7b36ba3626dd4e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:08d9d75ce2c1631968880f8e8f8b2f608677556fbdad0fe7a4e05828b64d5f86 · sha256:5a22e79d2bafa245… · /containers/cna/references/7

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer