CVE-2026-74586

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear new_transport when removing a peer

sctp_process_asconf_param() stores a newly added peer transport in

asoc->new_transport. After all parameters in the ASCONF chunk have been

processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the

new transport.

An authenticated ASCONF from a remote SCTP peer can add a transport and

remove it again with a wildcard DEL-IP parameter in the same chunk. The

wildcard deletion preserves the transport on which the ASCONF arrived, but

removes the newly added transport through

sctp_assoc_del_nonprimary_peers(). The removal does not clear

asoc->new_transport, leaving it pointing to the removed transport.

sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk->transport points

to the removed transport without holding a transport reference. During

local address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on

control_chunk_list. After the transport is fr

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References