Linux Kernel CVE-2026-63971

The affected component is the SCTP (Stream Control Transmission Protocol) implementation in net/sctp within the Linux kernel. SCTP supports a 'peeloff' operation (getsockopt with SCTP_SOCKOPT_PEELOFF) that detaches a single association from a one-to-many style socket into its own one-to-one socket, reassigning the association's backing socket pointer asoc->base.sk. sctp_wait_for_connect() sleeps until the association reaches ESTABLISHED, and while sleeping it drops and re-acquires the socket lock. The root cause is a classic time-of-check/time-of-use race (CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization), which here can escalate to using stale locking and a dangling/mismatched socket reference (CWE-416 Use-After-Free class behavior) because the function returns success without re-validating that sk still equals asoc->base.sk. The fix mirrors an existing guard in sctp_wait_for_sndbuf() by re-checking sk != asoc->base.sk after waking and returning an error on mismatch. The CPE data (cpe:2.3:a:linux:linux) is generic and does not itself pinpoint versions; the EUVD version ranges are authoritative here.