Use-after-free / type confusion in Linux kernel SCTP SCTP_SENDALL path

CVE-2026-46227 is a flaw in the Linux kernel SCTP implementation, specifically in the SCTP_SENDALL path of sctp_sendmsg(). The code iterates endpoint associations in ep->asocs using list_for_each_entry_safe(), which caches the next list element in a temporary cursor before the loop body executes. During iteration, sctp_sendmsg_to_asoc() can drop the socket lock inside sctp_wait_for_sndbuf(). While that lock is released, another thread can peel off the cached next association via SCTP_SOCKOPT_PEELOFF, causing sctp_sock_migrate() to remove it from the current endpoint list and attach it to a new endpoint list, and the migrated association may then be freed if the new socket is closed. The cached next pointer may also be freed by a network ABORT processed in softirq while the lock is dropped. Although the current association is revalidated after relocking using checks on asoc->base.sk and asoc->base.dead, the cached next cursor was not revalidated. As a result, iteration can advance to a stale pointer, causing either a use-after-free or a walk onto a different endpoint's list head, producing type confusion by treating &newep->asocs as a struct sctp_association *. The upstream fix re-derives the next iterator cursor from the current association after sctp_sendmsg_to_asoc() returns.