CVE-2026-74587

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the SCTP implementation. The addip last asconf variable caches outbound ASCONF chunks. When sctp asconf queue teardown() is called during peer restart handling via sctp sf do dupcook a(), it releases the cached chunk but fails to clear the addip last asconf pointer, leaving it dangling. A subsequent delayed authenticated ASCONF-ACK can trigger sctp sf do asconf ack(), which accesses the stale chunk and passes it to sctp process asconf ack(), leading to a use-after-free and a double release. Additionally, a race condition exists with T4 expiry where sctp sf t4 timer expire() may dereference a NULL pointer if it executes after the purge.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.