UBUNTU-CVE-2026-98846: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: sctp: check RCVSHUTDOWN after the sendmsg connect wait sctpwaitforconnect() drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurrent shutdown(fd, SHUTRD) sets RCVSHUTDOWN, the waiter breaks with err == 0 before checking asoc->base.dead. Its final sctpassociationput() can then free the association, leaving sctpsendmsgtoasoc() to continue with a dangling pointer. Check RCVSHUTDOWN along with the wait error in sctpsendmsgtoasoc() before using the association again. The check only accesses the socket, so it needs no additional association reference. Return the existing -ESRCH so that sctpsendmsg() skips freeing a new association that may already have been destroyed. Keep sctpwaitforconnect() unchanged to preserve its behavior for the connect() caller.