CVE-2026-64564
Received Received - Intake

Use-After-Free in Linux Kernel SCTP Implementation

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-64564
EUVD
EUVD-2026-52605

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of SCTP (Stream Control Transmission Protocol) ASCONF chunks during DEL-IP processing. A malicious ASCONF chunk can trick the system into freeing a transport structure prematurely, leading to use-after-free conditions and potential memory corruption.

Detection Guidance

This vulnerability affects the Linux kernel's SCTP implementation and requires kernel-level inspection. Detection involves checking kernel logs for SCTP-related errors or crashes, particularly after processing ASCONF chunks. Use commands like dmesg | grep sctp or journalctl -k | grep sctp to review kernel messages. If the system crashes or shows transport-related errors, it may indicate exploitation.

Impact Analysis

This flaw could allow an attacker to cause a denial of service (system crash) or potentially execute arbitrary code with kernel privileges. Systems using vulnerable Linux kernel versions with SCTP enabled are at risk.

Compliance Impact

This vulnerability affects compliance with standards and regulations like GDPR and HIPAA by potentially enabling denial-of-service attacks or unauthorized access to sensitive data through network disruption or memory corruption in the Linux kernel's SCTP protocol implementation.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this SCTP ASCONF processing vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64564. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart