CVE-2025-40331

In the Linux kernel, the following vulnerability has been resolved:

sctp: Prevent TOCTOU out-of-bounds write

For the following path not holding the sock lock,

sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()

make sure not to exceed bounds in case the address list has grown between buffer allocation (time-of-check) and write (time-of-use).

This vulnerability is rated as Moderate severity because exploiting it requires an unprivileged local user to win a specific timing window, limiting the primary impact to a local denial of service via kernel crash. In default Red Hat Enterprise Linux installations, the SCTP diagnostic module is not actively loaded unless explicitly invoked or queried by socket inspection utilities. Although a race condition during endpoint dump operations can result in memory corruption, the high attack complexity and necessity of concurrent local socket activity restrict its reliability and prevent remote exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.