CVE-2026-74587

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74587", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.918Z", "datePublished": "2026-08-22T15:31:39.810Z", "dateUpdated": "2026-10-16T19:05:58.841Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:13.798Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix use-after-free of cached ASCONF chunk\n\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\nASCONF-ACK completion path releases the chunk and clears the pointer.\n\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\nclearing addip_last_asconf. During peer restart handling,\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\nsctp_asconf_queue_teardown() while the association remains alive and leaves\nthe pointer dangling.\n\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\ncausing a use-after-free and a second release.\n\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\ntimer_delete(), which does not wait for a callback already running on\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\nthe purge and dereference NULL.\n\nClear addip_last_asconf after releasing the cached chunk, and make\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\nASCONF remains."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The UAF is triggered when the kernel processes inbound SCTP COOKIE-ECHO (peer restart) and ASCONF-ACK chunks from a remote association peer via sctp_rcv()/sctp_inq_push()/sctp_do_sm(), with no local syscall required on the victim.\nAC:L - The remote SCTP peer controls the full protocol sequence\u2014establishing an ADDIP-capable association, waiting for the victim's outstanding ASCONF, sending COOKIE-ECHO restart to purge queues, then delivering a delayed authenticated ASCONF-ACK\u2014without attacker-uncontrollable races or memory layout.\nPR:N - Exploitation requires only network access as an established SCTP association peer sending authenticated protocol traffic; no local Linux account, capability, or namespace privilege is needed on the victim host.\nUI:N - No victim user action is required beyond normal automated SCTP server/client operation; the attacker drives the entire trigger sequence with crafted COOKIE-ECHO and ASCONF-ACK packets on the existing association.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary.\nC:H - sctp_sf_do_asconf_ack() and sctp_process_asconf_ack() dereference the stale addip_last_asconf pointer to read freed sctp_chunk and skb metadata; UAF on slab-allocated chunk objects enables heap grooming for arbitrary kernel memory disclosure.\nI:H - The stale pointer causes sctp_process_asconf_ack() to perform a second sctp_chunk_free() on an already-freed chunk, yielding a kmem_cache double-free that can be leveraged for arbitrary kernel write or control-flow hijack.\nA:H - Dereferencing the freed cached ASCONF chunk during ASCONF-ACK processing can cause kernel oops/panic and repeatable remote denial of service against any SCTP endpoint handling the malicious peer traffic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/associola.c", "net/sctp/sm_statefuns.c"], "versions": [{"version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "10459b03e2d9ee12435e96f587de4d4cacdbf435", "status": "affected", "versionType": "git"}, {"version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "e1bb114e09372fd6e03387ced9ef566da336ed6c", "status": "affected", "versionType": "git"}, {"version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "179676f0166230c80053a392303485b37c93dd33", "status": "affected", "versionType": "git"}, {"version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d", "status": "affected", "versionType": "git"}, {"version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "618b5c6d049896fcfabb91afc072954c92cb2693", "status": "affected", "versionType": "git"}, {"version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "07daf4f9750104960a1d60831b2353c0d41f35fb", "status": "affected", "versionType": "git"}, {"version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "d949992bc3f00027a2c755e860a11950c75f6073", "status": "affected", "versionType": "git"}, {"version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "8c283e7b56adce00193837f3311b06662466fb21", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/associola.c", "net/sctp/sm_statefuns.c"], "versions": [{"version": "3.0", "status": "affected"}, {"version": "0", "lessThan": "3.0", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/10459b03e2d9ee12435e96f587de4d4cacdbf435"}, {"url": "https://git.kernel.org/stable/c/e1bb114e09372fd6e03387ced9ef566da336ed6c"}, {"url": "https://git.kernel.org/stable/c/179676f0166230c80053a392303485b37c93dd33"}, {"url": "https://git.kernel.org/stable/c/dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d"}, {"url": "https://git.kernel.org/stable/c/618b5c6d049896fcfabb91afc072954c92cb2693"}, {"url": "https://git.kernel.org/stable/c/07daf4f9750104960a1d60831b2353c0d41f35fb"}, {"url": "https://git.kernel.org/stable/c/d949992bc3f00027a2c755e860a11950c75f6073"}, {"url": "https://git.kernel.org/stable/c/8c283e7b56adce00193837f3311b06662466fb21"}], "title": "sctp: fix use-after-free of cached ASCONF chunk", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:01:25.161847Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:05:58.841Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:01:25.161847Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:01:26.045Z"}}], "cna": {"title": "sctp: fix use-after-free of cached ASCONF chunk", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The UAF is triggered when the kernel processes inbound SCTP COOKIE-ECHO (peer restart) and ASCONF-ACK chunks from a remote association peer via sctp_rcv()/sctp_inq_push()/sctp_do_sm(), with no local syscall required on the victim.\nAC:L - The remote SCTP peer controls the full protocol sequence\u2014establishing an ADDIP-capable association, waiting for the victim's outstanding ASCONF, sending COOKIE-ECHO restart to purge queues, then delivering a delayed authenticated ASCONF-ACK\u2014without attacker-uncontrollable races or memory layout.\nPR:N - Exploitation requires only network access as an established SCTP association peer sending authenticated protocol traffic; no local Linux account, capability, or namespace privilege is needed on the victim host.\nUI:N - No victim user action is required beyond normal automated SCTP server/client operation; the attacker drives the entire trigger sequence with crafted COOKIE-ECHO and ASCONF-ACK packets on the existing association.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary.\nC:H - sctp_sf_do_asconf_ack() and sctp_process_asconf_ack() dereference the stale addip_last_asconf pointer to read freed sctp_chunk and skb metadata; UAF on slab-allocated chunk objects enables heap grooming for arbitrary kernel memory disclosure.\nI:H - The stale pointer causes sctp_process_asconf_ack() to perform a second sctp_chunk_free() on an already-freed chunk, yielding a kmem_cache double-free that can be leveraged for arbitrary kernel write or control-flow hijack.\nA:H - Dereferencing the freed cached ASCONF chunk during ASCONF-ACK processing can cause kernel oops/panic and repeatable remote denial of service against any SCTP endpoint handling the malicious peer traffic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "10459b03e2d9ee12435e96f587de4d4cacdbf435", "versionType": "git"}, {"status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "e1bb114e09372fd6e03387ced9ef566da336ed6c", "versionType": "git"}, {"status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "179676f0166230c80053a392303485b37c93dd33", "versionType": "git"}, {"status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d", "versionType": "git"}, {"status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "618b5c6d049896fcfabb91afc072954c92cb2693", "versionType": "git"}, {"status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "07daf4f9750104960a1d60831b2353c0d41f35fb", "versionType": "git"}, {"status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "d949992bc3f00027a2c755e860a11950c75f6073", "versionType": "git"}, {"status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "lessThan": "8c283e7b56adce00193837f3311b06662466fb21", "versionType": "git"}], "programFiles": ["net/sctp/associola.c", "net/sctp/sm_statefuns.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.0"}, {"status": "unaffected", "version": "0", "lessThan": "3.0", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sctp/associola.c", "net/sctp/sm_statefuns.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/10459b03e2d9ee12435e96f587de4d4cacdbf435"}, {"url": "https://git.kernel.org/stable/c/e1bb114e09372fd6e03387ced9ef566da336ed6c"}, {"url": "https://git.kernel.org/stable/c/179676f0166230c80053a392303485b37c93dd33"}, {"url": "https://git.kernel.org/stable/c/dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d"}, {"url": "https://git.kernel.org/stable/c/618b5c6d049896fcfabb91afc072954c92cb2693"}, {"url": "https://git.kernel.org/stable/c/07daf4f9750104960a1d60831b2353c0d41f35fb"}, {"url": "https://git.kernel.org/stable/c/d949992bc3f00027a2c755e860a11950c75f6073"}, {"url": "https://git.kernel.org/stable/c/8c283e7b56adce00193837f3311b06662466fb21"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix use-after-free of cached ASCONF chunk\n\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\nASCONF-ACK completion path releases the chunk and clears the pointer.\n\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\nclearing addip_last_asconf. During peer restart handling,\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\nsctp_asconf_queue_teardown() while the association remains alive and leaves\nthe pointer dangling.\n\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\ncausing a use-after-free and a second release.\n\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\ntimer_delete(), which does not wait for a callback already running on\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\nthe purge and dereference NULL.\n\nClear addip_last_asconf after releasing the cached chunk, and make\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\nASCONF remains."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:13.798Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74587", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:05:58.841Z", "dateReserved": "2026-08-15T05:44:03.918Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:31:39.810Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sctp/associola.c", "net/sctp/sm_statefuns.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "10459b03e2d9ee12435e96f587de4d4cacdbf435", "status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "versionType": "git"}, {"lessThan": "e1bb114e09372fd6e03387ced9ef566da336ed6c", "status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "versionType": "git"}, {"lessThan": "179676f0166230c80053a392303485b37c93dd33", "status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "versionType": "git"}, {"lessThan": "dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d", "status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "versionType": "git"}, {"lessThan": "618b5c6d049896fcfabb91afc072954c92cb2693", "status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "versionType": "git"}, {"lessThan": "07daf4f9750104960a1d60831b2353c0d41f35fb", "status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "versionType": "git"}, {"lessThan": "d949992bc3f00027a2c755e860a11950c75f6073", "status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "versionType": "git"}, {"lessThan": "8c283e7b56adce00193837f3311b06662466fb21", "status": "affected", "version": "a000c01e60e40e15304ffe48fff051d17a7bea91", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sctp/associola.c", "net/sctp/sm_statefuns.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.0"}, {"lessThan": "3.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix use-after-free of cached ASCONF chunk\n\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\nASCONF-ACK completion path releases the chunk and clears the pointer.\n\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\nclearing addip_last_asconf. During peer restart handling,\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\nsctp_asconf_queue_teardown() while the association remains alive and leaves\nthe pointer dangling.\n\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\ncausing a use-after-free and a second release.\n\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\ntimer_delete(), which does not wait for a callback already running on\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\nthe purge and dereference NULL.\n\nClear addip_last_asconf after releasing the cached chunk, and make\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\nASCONF remains."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsctp: corrige el uso despu\u00e9s de liberaci\u00f3n de un fragmento ASCONF en cach\u00e9\n\naddip_last_asconf almacena en cach\u00e9 el fragmento ASCONF saliente pendiente. La ruta de finalizaci\u00f3n normal de ASCONF-ACK libera el fragmento y borra el puntero.\n\nSin embargo, sctp_asconf_queue_teardown() libera el fragmento en cach\u00e9 sin borrar addip_last_asconf. Durante el manejo de reinicio del par, sctp_sf_do_dupcook_a() encola SCTP_CMD_PURGE_ASCONF_QUEUE, lo que invoca sctp_asconf_queue_teardown() mientras la asociaci\u00f3n permanece activa y deja el puntero colgando.\n\nUn ASCONF-ACK autenticado retrasado puede entonces alcanzar sctp_sf_do_asconf_ack(), que accede al fragmento obsoleto y lo pasa a sctp_process_asconf_ack(), causando un uso despu\u00e9s de liberaci\u00f3n y una segunda liberaci\u00f3n.\n\nBorrar el puntero expone una condici\u00f3n de carrera con la expiraci\u00f3n de T4. El manejo de reinicio del par encola la detenci\u00f3n del temporizador antes de la purga, pero SCTP_CMD_TIMER_STOP usa timer_delete(), que no espera por una llamada de retorno ya en ejecuci\u00f3n en otra CPU. Dicha llamada de retorno puede alcanzar sctp_sf_t4_timer_expire() despu\u00e9s de la purga y desreferenciar NULL.\n\nBorrar addip_last_asconf despu\u00e9s de liberar el fragmento en cach\u00e9, y hacer que sctp_sf_t4_timer_expire() consuma una expiraci\u00f3n de T4 obsoleta si no queda ning\u00fan ASCONF pendiente."}], "id": "CVE-2026-74587", "lastModified": "2026-10-16T20:17:41.753", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74587", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:01:25.161847Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:30.830", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07daf4f9750104960a1d60831b2353c0d41f35fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/10459b03e2d9ee12435e96f587de4d4cacdbf435"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/179676f0166230c80053a392303485b37c93dd33"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/618b5c6d049896fcfabb91afc072954c92cb2693"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8c283e7b56adce00193837f3311b06662466fb21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d949992bc3f00027a2c755e860a11950c75f6073"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e1bb114e09372fd6e03387ced9ef566da336ed6c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: sctp: fix use-after-free of cached ASCONF chunk", "id": "2521434", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521434"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsctp: fix use-after-free of cached ASCONF chunk\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\nASCONF-ACK completion path releases the chunk and clears the pointer.\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\nclearing addip_last_asconf. During peer restart handling,\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\nsctp_asconf_queue_teardown() while the association remains alive and leaves\nthe pointer dangling.\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\ncausing a use-after-free and a second release.\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\ntimer_delete(), which does not wait for a callback already running on\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\nthe purge and dereference NULL.\nClear addip_last_asconf after releasing the cached chunk, and make\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\nASCONF remains.", "A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. During peer restart handling, the system improperly releases a cached ASCONF chunk without clearing its pointer, leading to a use-after-free vulnerability. A remote attacker could exploit this by sending a delayed authenticated ASCONF-ACK, causing the system to access freed memory. This could result in a system crash, leading to a denial of service."], "name": "CVE-2026-74587", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74587\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74587\nhttps://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74587-d6f8@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[a000c01e60e40e15304ffe48fff051d17a7bea91,10459b03e2d9ee12435e96f587de4d4cacdbf435)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[a000c01e60e40e15304ffe48fff051d17a7bea91,e1bb114e09372fd6e03387ced9ef566da336ed6c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[a000c01e60e40e15304ffe48fff051d17a7bea91,179676f0166230c80053a392303485b37c93dd33)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[a000c01e60e40e15304ffe48fff051d17a7bea91,dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[a000c01e60e40e15304ffe48fff051d17a7bea91,618b5c6d049896fcfabb91afc072954c92cb2693)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[a000c01e60e40e15304ffe48fff051d17a7bea91,07daf4f9750104960a1d60831b2353c0d41f35fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[a000c01e60e40e15304ffe48fff051d17a7bea91,d949992bc3f00027a2c755e860a11950c75f6073)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[a000c01e60e40e15304ffe48fff051d17a7bea91,8c283e7b56adce00193837f3311b06662466fb21)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.0,3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.265,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.216,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.183,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.152,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.104,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.45,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.9,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T16:30:05.475743+00:00", "updated": "2026-08-25T16:00:15.265725+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}