CVE-2026-74688sctp: clear control chunk transport if it is being removed
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately. If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer. Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free. Fix this by also clearing chunk->transport for queued control chunks in control_chunk_list when removing the transport.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before fad4766a74220fe579c6fcaa10ba01c23529814f; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before 936658ec41c28c397ef390140e02d4c91ade92f0; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before 8de65194a04d2552cd39b6c67d942d490f22d174; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before 6160e756db81d6cb63e3e2952efcf6c5134be385; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before 18d704bdd809377dfd81a3c2f42426763b5da227; 8a07eb0a50aebc8c95478d49c28c7f8419a26cef builds before 4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before c9158ceaf27780ef64534ad72f44ffde3f8ccc49 | CNA record |
References
- https://git.kernel.org/stable/c/dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886
- https://git.kernel.org/stable/c/fad4766a74220fe579c6fcaa10ba01c23529814f
- https://git.kernel.org/stable/c/936658ec41c28c397ef390140e02d4c91ade92f0
- https://git.kernel.org/stable/c/8de65194a04d2552cd39b6c67d942d490f22d174
- https://git.kernel.org/stable/c/6160e756db81d6cb63e3e2952efcf6c5134be385
- https://git.kernel.org/stable/c/18d704bdd809377dfd81a3c2f42426763b5da227
- https://git.kernel.org/stable/c/4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7
- https://git.kernel.org/stable/c/c9158ceaf27780ef64534ad72f44ffde3f8ccc49
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.