CVE-2026-63971

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A race condition exists in the sctp_wait_for_connect() function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a different socket. This can cause subsequent operations to access memory incorrectly, potentially leading to system instability or denial of service.

This vulnerability is rated as Moderate severity because exploitation requires local user access and precise timing to win a race condition between concurrent socket operations. The SCTP kernel module is not loaded by default on standard Red Hat Enterprise Linux installations unless explicitly configured or requested by applications. Consequently, systems running standard workloads that do not utilize SCTP networking protocols remain unexposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.