CVE-2026-74688
Received Received - Intake

SCTP Use-After-Free in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately. If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer. Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free. Fix this by also clearing chunk->transport for queued control chunks in control_chunk_list when removing the transport.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74688
EUVD
EUVD-2026-64375

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's SCTP implementation. It occurs when a transport is removed while a control chunk is queued, leaving a dangling pointer. When the chunk is later transmitted, the kernel dereferences the stale pointer, causing memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCTP implementation and may not have direct detection commands. Monitor kernel logs for SCTP-related errors or crashes, particularly after transport removals. Check for use-after-free errors in kernel messages using dmesg or journalctl.

Impact Analysis

This could lead to system crashes, privilege escalation, or arbitrary code execution if exploited. It affects systems using SCTP networking, potentially disrupting services or enabling unauthorized access.

Mitigation Strategies

Update the Linux kernel to the latest patched version that includes the fix for this SCTP vulnerability. Disable SCTP if not required, or restrict its use to trusted networks. Monitor kernel security advisories for further updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74688. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart