CVE-2026-74586 - Vulnerability Details

- sctp: clear new_transport when removing a peer

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear new_transport when removing a peer

sctp_process_asconf_param() stores a newly added peer transport in
asoc->new_transport. After all parameters in the ASCONF chunk have been
processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the
new transport.

An authenticated ASCONF from a remote SCTP peer can add a transport and
remove it again with a wildcard DEL-IP parameter in the same chunk. The
wildcard deletion preserves the transport on which the ASCONF arrived, but
removes the newly added transport through
sctp_assoc_del_nonprimary_peers(). The removal does not clear
asoc->new_transport, leaving it pointing to the removed transport.

sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk->transport points
to the removed transport without holding a transport reference. During
local address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on
control_chunk_list. After the transport is freed by RCU, a successful
ASCONF_ACK for the replacement address releases the queued HEARTBEAT and
sctp_outq_select_transport() reads the freed transport's state.

The issue was found during a static audit of SCTP objects. With an
authenticated peer, the reproducer triggered the same KASAN report in 2
of 2 unpatched runs on a KASAN-enabled netdev/main kernel:

BUG: KASAN: slab-use-after-free in sctp_outq_select_transport
Read of size 4 at addr ffff88800b9bd95c by task python3/197

Call Trace:
sctp_outq_select_transport+0x549/0x8b0 [sctp]
sctp_outq_flush+0x306/0x2c60 [sctp]
sctp_transport_immediate_rtx+0xaf/0x260 [sctp]
sctp_process_asconf_ack+0xa48/0xf70 [sctp]

Allocated by task 197:
sctp_transport_new+0x68/0x650 [sctp]
sctp_assoc_add_peer+0x258/0x12a0 [sctp]
sctp_process_asconf+0x5e9/0x1090 [sctp]

Last potentially related work creation:
__call_rcu_common.constprop.0+0x77/0xb70
sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp]
sctp_process_asconf+0xd9c/0x1090 [sctp]

The first invalid access was a four-byte read of transport->state at
net/sctp/outqueue.c:833. The same reproducer completed the full
authenticated ASCONF and local-address replacement sequence with this
change without a KASAN report or oops.

Clear new_transport when its peer is removed, before it can be used to
create the HEARTBEAT.

Published: 2026-08-22

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

An authenticated SCTP peer can send an ASCONF packet that adds a new transport and then immediately deletes it with a wildcard DEL‑IP parameter. The kernel code fails to clear the pointer to the removed transport before attempting to send a HEARTBEAT on that transport. This results in a use‑after‑free, leading to arbitrary memory reads of freed kernel objects and possible kernel crashes. The weakness is captured by CWE‑416.

Affected Systems

Any Linux kernel that includes an SCTP stack and compiles the SCTP module is vulnerable. The advisory does not specify a version range, so all unpatched kernel builds that enable SCTP are potentially affected. Kernels with SCTP disabled or that are compiled without SCTP support would not be impacted.

Risk and Exploitability

The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been reported. Nevertheless, a use‑after‑free within the kernel can cause a kernel panic or memory corruption, which could provide an attacker with high‑privilege code execution if the kernel is running in an untrusted environment. Because the flaw requires an authenticated SCTP session, it is limited to hosts that accept SCTP connections from an adversary. The EPSS score is not available, so the likelihood of exploitation cannot be quantified from the advisory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6af29ccc223b0feb6fc6112281c3fa3cdb1afddf`	affected	< c0f973bb5118dd1b146cda3fcc8af6f6057befec
`6af29ccc223b0feb6fc6112281c3fa3cdb1afddf`	affected	< 3b539b317cd052236fed0350364ff1268996ba46
`6af29ccc223b0feb6fc6112281c3fa3cdb1afddf`	affected	< db9d8e3b670f841755bc2018f178472dc6064d27
`6af29ccc223b0feb6fc6112281c3fa3cdb1afddf`	affected	< 31efa656cf6aface26e88f038c14f22ee6ca1500
`6af29ccc223b0feb6fc6112281c3fa3cdb1afddf`	affected	< 291accf36febce751021888de5f15090f4875b56
`6af29ccc223b0feb6fc6112281c3fa3cdb1afddf`	affected	< ca33df36aa0143a1d04f57d2086020c12e7eddb7
`6af29ccc223b0feb6fc6112281c3fa3cdb1afddf`	affected	< 163847552a571bd55094291f4ffcdc1de0f14a7b
`6af29ccc223b0feb6fc6112281c3fa3cdb1afddf`	affected	< beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3

Linux

affected

Version	Status	Constraints
`3.2`	affected	—
`0`	unaffected	< 3.2
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the vendor‑released kernel patch that clears the new_transport pointer before a transport is freed.
If a patch is not immediately available, disable SCTP globally by setting net.sctp.enable=0 or block SCTP traffic with firewall rules to prevent ASCONF packets from reaching the kernel.
Continuously monitor kernel logs (e.g., dmesg, /var/log/kern.log) for KASAN or oops messages related to SCTP to detect ongoing attempts to trigger the flaw.

Generated by OpenCVE AI on August 22, 2026 at 19:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/163847552a571bd55094291f4ffcdc1de0f14a7b
https://git.kernel.org/stable/c/291accf36febce751021888de5f15090f4875b56
https://git.kernel.org/stable/c/31efa656cf6aface26e88f038c14f22ee6ca1500
https://git.kernel.org/stable/c/3b539b317cd052236fed0350364ff1268996ba46
https://git.kernel.org/stable/c/beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3
https://git.kernel.org/stable/c/c0f973bb5118dd1b146cda3fcc8af6f6057befec
https://git.kernel.org/stable/c/ca33df36aa0143a1d04f57d2086020c12e7eddb7
https://git.kernel.org/stable/c/db9d8e3b670f841755bc2018f178472dc6064d27

History

Sat, 22 Aug 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the new transport. An authenticated ASCONF from a remote SCTP peer can add a transport and remove it again with a wildcard DEL-IP parameter in the same chunk. The wildcard deletion preserves the transport on which the ASCONF arrived, but removes the newly added transport through sctp_assoc_del_nonprimary_peers(). The removal does not clear asoc->new_transport, leaving it pointing to the removed transport. sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk->transport points to the removed transport without holding a transport reference. During local address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on control_chunk_list. After the transport is freed by RCU, a successful ASCONF_ACK for the replacement address releases the queued HEARTBEAT and sctp_outq_select_transport() reads the freed transport's state. The issue was found during a static audit of SCTP objects. With an authenticated peer, the reproducer triggered the same KASAN report in 2 of 2 unpatched runs on a KASAN-enabled netdev/main kernel: BUG: KASAN: slab-use-after-free in sctp_outq_select_transport Read of size 4 at addr ffff88800b9bd95c by task python3/197 Call Trace: sctp_outq_select_transport+0x549/0x8b0 [sctp] sctp_outq_flush+0x306/0x2c60 [sctp] sctp_transport_immediate_rtx+0xaf/0x260 [sctp] sctp_process_asconf_ack+0xa48/0xf70 [sctp] Allocated by task 197: sctp_transport_new+0x68/0x650 [sctp] sctp_assoc_add_peer+0x258/0x12a0 [sctp] sctp_process_asconf+0x5e9/0x1090 [sctp] Last potentially related work creation: __call_rcu_common.constprop.0+0x77/0xb70 sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp] sctp_process_asconf+0xd9c/0x1090 [sctp] The first invalid access was a four-byte read of transport->state at net/sctp/outqueue.c:833. The same reproducer completed the full authenticated ASCONF and local-address replacement sequence with this change without a KASAN report or oops. Clear new_transport when its peer is removed, before it can be used to create the HEARTBEAT.
Title		sctp: clear new_transport when removing a peer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/163847552a571bd55094291f4ffcdc1de0f14a7b https://git.kernel.org/stable/c/291accf36febce751021888de5f15090f4875b56 https://git.kernel.org/stable/c/31efa656cf6aface26e88f038c14f22ee6ca1500 https://git.kernel.org/stable/c/3b539b317cd052236fed0350364ff1268996ba46 https://git.kernel.org/stable/c/beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3 https://git.kernel.org/stable/c/c0f973bb5118dd1b146cda3fcc8af6f6057befec https://git.kernel.org/stable/c/ca33df36aa0143a1d04f57d2086020c12e7eddb7 https://git.kernel.org/stable/c/db9d8e3b670f841755bc2018f178472dc6064d27

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:31:39.094Z

Updated: 2026-08-22T15:31:39.094Z

Reserved: 2026-08-15T05:44:03.918Z

Link: CVE-2026-74586

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:30.687

Modified: 2026-08-22T16:16:30.687

Link: CVE-2026-74586

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-22T19:30:17Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object