CVE-2026-74587
Received Received - Intake

Use-After-Free in Linux Kernel SCTP

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp_asconf_queue_teardown() releases the cached chunk without clearing addip_last_asconf. During peer restart handling, sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes sctp_asconf_queue_teardown() while the association remains alive and leaves the pointer dangling. A delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(), which accesses the stale chunk and passes it to sctp_process_asconf_ack(), causing a use-after-free and a second release. Clearing the pointer exposes a race with T4 expiry. Peer restart handling queues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses timer_delete(), which does not wait for a callback already running on another CPU. Such a callback can reach sctp_sf_t4_timer_expire() after the purge and dereference NULL. Clear addip_last_asconf after releasing the cached chunk, and make sctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding ASCONF remains.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74587
EUVD
EUVD-2026-64524

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's SCTP implementation. It involves a cached ASCONF chunk that gets freed but its pointer is not cleared, leading to potential memory corruption when the stale pointer is accessed later.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCTP implementation and may not have direct detection commands. Monitor kernel logs for SCTP-related errors or crashes, particularly during association teardown or peer restart events. Check for use-after-free errors in system logs using dmesg or journalctl.

Impact Analysis

An attacker could exploit this to cause a denial of service or execute arbitrary code with kernel privileges on systems using vulnerable SCTP configurations. This may lead to system crashes or unauthorized access.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the use-after-free issue in SCTP. If immediate patching is not possible, consider disabling SCTP (if not required) by unloading the sctp module or restricting its use via kernel parameters. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart