sctp_sock_migrate() transfers queued DATA skbs from the old socket to
the new one. skb_orphan() invokes sctp_wfree() during that transfer and
drops the skb-owned shared-key reference.

If userspace has removed that key from the association, this can be the
final reference. The following sctp_set_owner_w() then dereferences the
freed chunk->shkey while trying to take the new owner reference.

Take a temporary shared-key reference before orphaning the skb and
release it after the new owner has taken its reference. This preserves
the selected authentication key throughout the ownership transfer.

Fixes: 1b1e0bc99474 ("sctp: add refcnt support for sh_key")
Bug found and triaged by OpenAI Security Research and 
validated by Trail of Bits.

Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
Trail of Bits has a reproducer for this bug that triggers a 
KASAN use-after-free and can share if needed.

 net/sctp/socket.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c7b9e325e..4a08023d5 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -147,9 +147,19 @@ static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
 
 static void sctp_clear_owner_w(struct sctp_chunk *chunk)
 {
+	/* Keep the shkey alive until the new owner takes its reference. */
+	if (chunk->shkey)
+		sctp_auth_shkey_hold(chunk->shkey);
 	skb_orphan(chunk->skb);
 }
 
+static void sctp_set_owner_w_migrate(struct sctp_chunk *chunk)
+{
+	sctp_set_owner_w(chunk);
+	if (chunk->shkey)
+		sctp_auth_shkey_release(chunk->shkey);
+}
+
 #define traverse_and_process()	\
 do {				\
 	msg = chunk->msg;	\
@@ -9632,7 +9642,7 @@ static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 	lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
 	sctp_for_each_tx_datachunk(assoc, true, sctp_clear_owner_w);
 	sctp_assoc_migrate(assoc, newsk);
-	sctp_for_each_tx_datachunk(assoc, false, sctp_set_owner_w);
+	sctp_for_each_tx_datachunk(assoc, false, sctp_set_owner_w_migrate);
 
 	/* If the association on the newsk is already closed before accept()
 	 * is called, set RCV_SHUTDOWN flag.
-- 
2.53.0

On Fri, Jul 31, 2026 at 8:06 AM David Lee <david.lee@trailofbits.com> wrote:
>
> sctp_sock_migrate() transfers queued DATA skbs from the old socket to
> the new one. skb_orphan() invokes sctp_wfree() during that transfer and
> drops the skb-owned shared-key reference.
>
> If userspace has removed that key from the association, this can be the
> final reference. The following sctp_set_owner_w() then dereferences the
> freed chunk->shkey while trying to take the new owner reference.
>
> Take a temporary shared-key reference before orphaning the skb and
> release it after the new owner has taken its reference. This preserves
> the selected authentication key throughout the ownership transfer.
>
> Fixes: 1b1e0bc99474 ("sctp: add refcnt support for sh_key")
> Bug found and triaged by OpenAI Security Research and
> validated by Trail of Bits.
>
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

The "Fixes: " is not together with others at the end, and the "Signed-off-by:"
for yourself is also missed:

Signed-off-by: David Lee <david.lee@trailofbits.com>

Patch looks good to me:

Acked-by: Xin Long <lucien.xin@gmail.com>

Not sure if you need to repost for fixing the tags, let's see.

Thanks.

Hi Xin Long,

Is there any progress regarding this patch?

Best
Zihua GUO.

On Wed, Sep 9, 2026 at 10:08 PM <scott_gzh@163.com> wrote:
>
> Hi Xin Long,
>
> Is there any progress regarding this patch?
>

I think you need to post v2 with the tag issues addressed.

Thanks.