CVE-2026-74688 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
sctp: clear control chunk transport if it is being removed
sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately.
If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer.
Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free.
Fix this by also clearing chunk->transport for queued control chunks in control_chunk_list when removing the transport.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified within the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation stems from an improper handling of reference counting and pointer lifecycle management during peer removal operations. Specifically, the function sctp_make_heartbeat_ack() creates a heartbeat acknowledgment chunk by caching the destination transport structure in the chunk->transport field without acquiring a proper reference count on that object. This design choice assumes immediate transmission or safe disposal, but under specific configuration conditions where src_out_of_asoc_ok is enabled, the generated HEARTBEAT ACK may remain queued on the control_chunk_list rather than being transmitted immediately to the network stack.
The critical failure occurs when the peer transport associated with this queued chunk is removed from the association. The function sctp_assoc_rm_peer() correctly drops the reference to the transport and schedules it for Read-Copy-Update (RCU) freeing, which allows for safe memory reclamation after a grace period. However, during this cleanup process, the kernel only clears cached transport pointers located in the out_chunk_list. It fails to clear the corresponding chunk->transport pointer within chunks residing on the control_chunk_list. Consequently, any queued heartbeat acknowledgment retains a stale pointer to a transport structure that has already been deallocated or is in the process of being freed.
This discrepancy leads directly to a use-after-free vulnerability. When an ASCONF_ACK message clears its suppression flag, it triggers the transmission of pending chunks on the control_chunk_list. Upon attempting to send this queued heartbeat acknowledgment, the SCTP stack dereferences the stale transport pointer stored in chunk->transport. Since the underlying memory has likely been reclaimed or repurposed by other kernel allocations during the RCU grace period, this access results in undefined behavior. In practical terms, this can lead to a kernel panic due to accessing invalid memory addresses, or potentially allow for arbitrary code execution if an attacker can control the contents of the freed memory region and predict its allocation timing.
From a classification perspective, this flaw aligns with CWE-416, Use After Free, as it involves referencing memory after it has been freed. In terms of attack vectors, this vulnerability could be leveraged within the ATT&CK framework under techniques related to privilege escalation or denial of service, depending on whether the attacker can trigger the specific sequence of peer removal and chunk transmission remotely. The impact is significant because SCTP is often used in critical infrastructure and high-availability applications where kernel stability is paramount.
To mitigate this vulnerability, it is essential that system administrators ensure their Linux kernels are updated to versions containing the fix for sctp_assoc_rm_peer(). This patch modifies the peer removal logic to also clear the chunk->transport pointer for queued control chunks on the control_chunk_list when a transport is being removed. For systems where immediate kernel updates are not feasible, restricting SCTP usage or disabling src_out_of_asoc_ok if it is not strictly required may reduce the attack surface by preventing the queuing of heartbeat acknowledgments in states vulnerable to this race condition. Regular patching and monitoring for kernel panics related to network stack operations remain critical defense strategies against such low-level memory management flaws.