CVE-2026-74586

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the SCTP implementation of the Linux kernel. An authenticated remote SCTP peer can trigger this by sending an ASCONF chunk that simultaneously adds a transport and removes it using a wildcard DEL-IP parameter. The function sctp process asconf param() stores the new transport in asoc->new transport, but the subsequent removal via sctp assoc del nonprimary peers() fails to clear this pointer. Consequently, sctp sf do asconf() creates a HEARTBEAT pointing to the freed transport. When a subsequent ASCONF ACK for a replacement address is processed, sctp outq select transport() attempts to read the state of the already freed transport, leading to a memory corruption error.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.