7.8

CVE-2026-63971: linux Race Condition

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2026-63971DEBIAN-CVE-2026-63971
Published 19-07-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-63971 is a high (CVSS 7.8) Race Condition vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.3% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.13%
0%100%
Low · -0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 159 · Related 155
OPENSUSE-SU-2026:21555-1RHSA-2026:66324RHSA-2026:66325RHSA-2026:67150RHSA-2026:85321SUSE-SU-2026:23066-1

Showing 100 of 159. Use Open JSON for the complete list.

Timeline

  1. 19-07-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_for_connect() drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the association to a new socket via getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After re-acquiring the old socket lock, sctp_wait_for_connect() returns success without noticing the migration — the caller then accesses the association under the wrong lock in sctp_datamsg_from_user(). Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf() already has, returning an error if the association was migrated while we slept.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.13%

Chance of exploitation in the next 30 days

Percentile

2%

Versus all other CVEs

30-day change

-0.04 pp

From 0.17% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.13%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu163 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-146.146 | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1066.69 | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 668c9beb9020d5834ee9e43c208190a07d2b1928, < 0e0d5bc76fd4267a71334fcc8f1a5fbcf997845d | ≥ 668c9beb9020d5834ee9e43c208190a07d2b1928, < bcfeac79af740735ace44008b4a11b8e5add20f5 | ≥ 668c9beb9020d5834ee9e43c208190a07d2b1928, < 8e9b56051d24540cfbf39194618708c4a7633549 | ≥ 668c9beb9020d5834ee9e43c208190a07d2b1928, < 634a9af8a26a84d8b0d7b3b643204b344b42d9fb | ≥ 668c9beb9020d5834ee9e43c208190a07d2b1928, < 7d2038d4b80166f7bead8d07eba3b97405816c21 | ≥ 668c9beb9020d5834ee9e43c208190a07d2b1928, < 68667ee4c7dadf7f63167234e2a1af09b3f7874e | ≥ 668c9beb9020d5834ee9e43c208190a07d2b1928, < 6140cfa721451fa6e18e134e709703c2bf34d0fb | ≥ 668c9beb9020d5834ee9e43c208190a07d2b1928, < f14fe6395a8b3d961a61e138ad7b36ba3626dd4e | 4.16
  • linux_kernel≥ 4.16, < 5.10.259 | ≥ 5.11, < 5.15.210 | ≥ 5.16, < 6.1.176 | ≥ 6.2, < 6.6.143 | ≥ 6.7, < 6.12.93 | ≥ 6.13, < 6.18.35 | ≥ 6.19, < 7.0.12 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3 | 7.1:rc4 | 7.1:rc5
Debian1 product
  • linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.12-1

3 vendors · 166 products

References

32 links
Show all 32 references