CVE-2026-74587

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix use-after-free of cached ASCONF chunk

addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal

ASCONF-ACK completion path releases the chunk and clears the pointer.

However, sctp_asconf_queue_teardown() releases the cached chunk without

clearing addip_last_asconf. During peer restart handling,

sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes

sctp_asconf_queue_teardown() while the association remains alive and leaves

the pointer dangling.

A delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),

which accesses the stale chunk and passes it to sctp_process_asconf_ack(),

causing a use-after-free and a second release.

Clearing the pointer exposes a race with T4 expiry. Peer restart handling

queues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses

timer_delete(), which does not wait for a callback already running on

another CPU. Such a cal

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References