Linux Kernel Vulnerability in SCTP Stream Number Handling

CVE-2023-53296

What is CVE-2023-53296?

A vulnerability in the Linux kernel related to Stream Control Transmission Protocol (SCTP) can lead to unexpected behavior in message sending. When a client is connected with a specific out stream count, a condition can arise where messages are sent on a non-existent stream after a thread wakes from waiting for a send buffer. This issue occurs due to a race condition in which the out stream count may decrease while another thread attempts to send messages, potentially causing a crash. The patch added to address this issue involves checking the send stream number to ensure stability and prevent null pointer dereferencing.

References