CVE-2026-74588

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free read exists in the SCTP implementation of the Linux kernel. The issue occurs within the sctp outq flush rtx() function, which moves a gap-acked chunk to another transport's transmitted list without updating the chunk->transport pointer. If the original transport is subsequently removed via sctp assoc rm peer() (for example, during an ASCONF Delete-IP operation) and freed by sctp transport free(), the chunk is left with a dangling pointer. When a SACK (Selective Acknowledgment) clears the tsn gap acked flag, the system attempts to access the freed transport to update flight size within the sctp check transmitted() function, leading to a memory corruption error.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.