CVE-2026-74588 - Vulnerability Details

- sctp: keep chunk->transport in step with the list it is queued on

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: keep chunk->transport in step with the list it is queued on

__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's
transmitted list without updating chunk->transport:

if (chunk->tsn_gap_acked) {
list_move_tail(&chunk->transmitted_list,
&transport->transmitted);
continue;
}

The chunk then sits on a live transport's list while chunk->transport still
names a different one. If that transport is removed - sctp_assoc_rm_peer()
from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk
is left with a dangling pointer. sctp_assoc_rm_peer() scrubs
peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on
neither.

The pointer is not followed while tsn_gap_acked is set. A SACK that
reneges on the TSN clears the flag, and the next SACK reaches

tchunk->transport->flight_size -= sctp_data_size(tchunk);

inside the freed transport. KASAN reports a slab-use-after-free read in
sctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the
removal and the SACKs come from the association peer.

Set chunk->transport at the move. The ordinary resend path needs nothing:
it reaches its list_move_tail() only after sctp_packet_append_chunk()
returned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the
chunk by then.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Published: 2026-08-22

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel SCTP implementation moves a chunk onto another transport’s transmitted list without updating the chunk’s transport pointer, which can leave the chunk pointing to a freed transport object. When a subsequent SACK clears the gap‑acked flag, the code dereferences the dangling pointer, resulting in a slab‑use‑after‑free read and possible exploitation by an attacker to execute arbitrary code at kernel level.

Affected Systems

Linux kernel, all variants that include the SCTP stack. The vulnerability is present in any kernel configuration that builds the SCTP transport module; no specific kernel version is listed.

Risk and Exploitability

EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, a use‑after‑free in kernel space can provide local privilege escalation to an attacker with the ability to initiate SCTP traffic. The defect requires the attacker to control an SCTP association that triggers an ASCONF Delete‑IP and subsequently receives a SACK, which may be achievable in environments that allow untrusted SCTP peers.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6575fb17230814b48b471727c8410c0aadff9274
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6b9e2ea2057113f3393990ba646d2d97c719a80d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 874a7c2b5e184f06134fdfde27e9ce9271bafe58
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1adf929121e13e0b19200bb9fef715b918d483fe
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e2e7c1de0e226ca1b7fea2de57a6c9bca408709b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 9f2cf069a9a72a2d6b97ca8b4c70e714aac99749

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6575fb17230814b48b471727c8410c0aadff9274)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6b9e2ea2057113f3393990ba646d2d97c719a80d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,874a7c2b5e184f06134fdfde27e9ce9271bafe58)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1adf929121e13e0b19200bb9fef715b918d483fe)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e2e7c1de0e226ca1b7fea2de57a6c9bca408709b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9f2cf069a9a72a2d6b97ca8b4c70e714aac99749)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest kernel patch that corrects the SCTP chunk transport pointer handling.
If SCTP is not needed, compile the kernel without SCTP support or unload the SCTP module.
As a temporary measure, block SCTP traffic from untrusted networks via firewall or network segmentation.

Generated by OpenCVE AI on August 22, 2026 at 17:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe
https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d
https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b
https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274
https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d
https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58
https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749
https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b

History

Sat, 22 Aug 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a slab-use-after-free read in sctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the removal and the SACKs come from the association peer. Set chunk->transport at the move. The ordinary resend path needs nothing: it reaches its list_move_tail() only after sctp_packet_append_chunk() returned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the chunk by then. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Title		sctp: keep chunk->transport in step with the list it is queued on
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274 https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58 https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749 https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:31:40.466Z

Updated: 2026-08-22T15:31:40.466Z

Reserved: 2026-08-15T05:44:03.918Z

Link: CVE-2026-74588

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:30.960

Modified: 2026-08-22T16:16:30.960

Link: CVE-2026-74588

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-22T18:00:04Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object