{"id":"CVE-2026-74688","revision":"fa3f8426ff4945e7adf5e27256711446","records":[{"revision":"fa3f8426ff4945e7adf5e27256711446","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74688","aliases":[],"title":"sctp: clear control chunk transport if it is being removed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear control chunk transport if it is being removed\n\nsctp_make_heartbeat_ack() caches the destination transport in\nchunk->transport without taking a reference. When src_out_of_asoc_ok is\nenabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead\nof being transmitted immediately.\n\nIf the peer transport is removed while the chunk is still queued,\nsctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing,\nbut only clears cached transport pointers in out_chunk_list.  The queued\ncontrol chunk therefore retains a dangling transport pointer.\n\nOnce an ASCONF_ACK clears the suppression and the queued control chunk is\ntransmitted, SCTP dereferences the stale transport pointer, leading to a\nuse-after-free.\n\nFix this by also clearing chunk->transport for queued control chunks in\ncontrol_chunk_list when removing the transport.","state":0,"publishedAt":"2026-08-22T15:32:53.423+00:00","modifiedAt":"2026-10-16T19:16:09.209+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sctp/associola.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"8a07eb0a50aebc8c95478d49c28c7f8419a26cef\",\n                            \"lessThan\": \"dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8a07eb0a50aebc8c95478d49c28c7f8419a26cef\",\n                            \"lessThan\": \"fad4766a74220fe579c6fcaa10ba01c23529814f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8a07eb0a50aebc8c95478d49c28c7f8419a26cef\",\n                            \"lessThan\": \"936658ec41c28c397ef390140e02d4c91ade92f0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8a07eb0a50aebc8c95478d49c28c7f8419a26cef\",\n                            \"lessThan\": \"8de65194a04d2552cd39b6c67d942d490f22d174\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8a07eb0a50aebc8c95478d49c28c7f8419a26cef\",\n                            \"lessThan\": \"6160e756db81d6cb63e3e2952efcf6c5134be385\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8a07eb0a50aebc8c95478d49c28c7f8419a26cef\",\n                            \"lessThan\": \"18d704bdd809377dfd81a3c2f42426763b5da227\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8a07eb0a50aebc8c95478d49c28c7f8419a26cef\",\n                            \"lessThan\": \"4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8a07eb0a50aebc8c95478d49c28c7f8419a26cef\",\n                            \"lessThan\": \"c9158ceaf27780ef64534ad72f44ffde3f8ccc49\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sctp/associola.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.152\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.104\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.45\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.9\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886","https://git.kernel.org/stable/c/fad4766a74220fe579c6fcaa10ba01c23529814f","https://git.kernel.org/stable/c/936658ec41c28c397ef390140e02d4c91ade92f0","https://git.kernel.org/stable/c/8de65194a04d2552cd39b6c67d942d490f22d174","https://git.kernel.org/stable/c/6160e756db81d6cb63e3e2952efcf6c5134be385","https://git.kernel.org/stable/c/18d704bdd809377dfd81a3c2f42426763b5da227","https://git.kernel.org/stable/c/4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7","https://git.kernel.org/stable/c/c9158ceaf27780ef64534ad72f44ffde3f8ccc49"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74688","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74688","identifiers":["CVE-2026-74688"]},"retained":false,"historicalAffected":[]}],"coverage":[]}