CVE-2026-74688

sctp: clear control chunk transport if it is being removed

State: Published
Severity: 9.8 Critical
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear control chunk transport if it is being removed

sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately.

If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer.

Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free.

Fix this by also clearing chunk->transport for queued control chunks in control_chunk_list when removing the transport.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886Affected 8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before fad4766a74220fe579c6fcaa10ba01c23529814fAffected 8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before 936658ec41c28c397ef390140e02d4c91ade92f0Affected 8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before 8de65194a04d2552cd39b6c67d942d490f22d174Affected 8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before 6160e756db81d6cb63e3e2952efcf6c5134be385Affected 8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before 18d704bdd809377dfd81a3c2f42426763b5da227Affected 8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before 4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7Affected 8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before c9158ceaf27780ef64534ad72f44ffde3f8ccc49Affected
LinuxLinux	3.1Affected before 3.1Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886Affected
8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before fad4766a74220fe579c6fcaa10ba01c23529814fAffected
8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before 936658ec41c28c397ef390140e02d4c91ade92f0Affected
8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before 8de65194a04d2552cd39b6c67d942d490f22d174Affected
8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before 6160e756db81d6cb63e3e2952efcf6c5134be385Affected
8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before 18d704bdd809377dfd81a3c2f42426763b5da227Affected
8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before 4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7Affected
8a07eb0a50aebc8c95478d49c28c7f8419a26cef to before c9158ceaf27780ef64534ad72f44ffde3f8ccc49Affected

LinuxLinux

3.1Affected
before 3.1Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.