{"id":"CVE-2021-46999","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: do asoc update earlier in sctp_sf_do_dupcook_a\n\nThere's a panic that occurs in a few of envs, the call trace is as below:\n\n  [] general protection fault, ..","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: do asoc update earlier in sctp_sf_do_dupcook_a\n\nThere's a panic that occurs in a few of envs, the call trace is as below:\n\n  [] general protection fault, ... 0x29…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.19.123, < 4.19.191","linux_kernel >= 5.4.41, < 5.4.120","linux_kernel >= 5.7, < 5.10.38","linux_kernel >= 5.11, < 5.11.22","linux_kernel >= 5.12, < 5.12.5"],"patched":["linux_kernel 5.12.5"],"published":"2024-02-28","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-46999","references":[{"url":"https://git.kernel.org/stable/c/0bfd913c2121b3d553bfd52810fe6061d542d625","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35b4f24415c854cd718ccdf38dbea6297f010aae","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61b877bad9bb0d82b7d8841be50872557090a704","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1b31948c0af44628e43353828453461bb74098f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d624f2991b977821375fbd56c91b0c91d456a697","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f01988ecf3654f805282dce2d3bb9afe68d2691e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0bfd913c2121b3d553bfd52810fe6061d542d625","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/35b4f24415c854cd718ccdf38dbea6297f010aae","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/61b877bad9bb0d82b7d8841be50872557090a704","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/b1b31948c0af44628e43353828453461bb74098f","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/d624f2991b977821375fbd56c91b0c91d456a697","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/f01988ecf3654f805282dce2d3bb9afe68d2691e","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00736,"epssPercentile":0.52469,"ingestedAt":"2026-08-04T10:39:39.000Z","slug":"CVE-2021-46999","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: do asoc update earlier in sctp_sf_do_dupcook_a\n\nThere's a panic that occurs in a few of envs, the call trace is as below:\n\n  [] general protection fault, ... 0x29acd70f1000a: 0000 [#1] SMP PTI\n  [] RIP: 0010:sctp_ulpevent_notify_peer_addr_change+0x4b/0x1fa [sctp]\n  []  sctp_assoc_control_transport+0x1b9/0x210 [sctp]\n  []  sctp_do_8_2_transport_strike.isra.16+0x15c/0x220 [sctp]\n  []  sctp_cmd_interpreter.isra.21+0x1231/0x1a10 [sctp]\n  []  sctp_do_sm+0xc3/0x2a0 [sctp]\n  []  sctp_generate_timeout_event+0x81/0xf0 [sctp]\n\nThis is caused by a transport use-after-free issue. When processing a\nduplicate COOKIE-ECHO chunk in sctp_sf_do_dupcook_a(), both COOKIE-ACK\nand SHUTDOWN chunks are allocated with the transort from the new asoc.\nHowever, later in the sideeffect machine, the old asoc is used to send\nthem out and old asoc's shutdown_last_sent_to is set to the transport\nthat SHUTDOWN chunk attached to in sctp_cmd_setup_t2(), which actually\nbelongs to the new asoc. After the new_asoc is freed and the old asoc\nT2 timeout, the old asoc's shutdown_last_sent_to that is already freed\nwould be accessed in sctp_sf_t2_timer_expire().\n\nThanks Alexander and Jere for helping dig into this issue.\n\nTo fix it, this patch is to do the asoc update first, then allocate\nthe COOKIE-ACK and SHUTDOWN chunks with the 'updated' old asoc. This\nwould make more sense, as a chunk from an asoc shouldn't be sent out\nwith another asoc. We had fixed quite a few issues caused by this.\n\n## Affected\n\n- `linux_kernel >= 4.19.123, < 4.19.191`\n- `linux_kernel >= 5.4.41, < 5.4.120`\n- `linux_kernel >= 5.7, < 5.10.38`\n- `linux_kernel >= 5.11, < 5.11.22`\n- `linux_kernel >= 5.12, < 5.12.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 5.12.5`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}