CVE-2026-74688

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the SCTP implementation. The function sctp make heartbeat ack() caches the destination transport in the chunk->transport variable without taking a reference. When src out of asoc ok is enabled, a HEARTBEAT ACK may be queued on the control chunk list instead of being sent immediately. If the peer transport is removed while the chunk is queued, sctp assoc rm peer() drops the transport and schedules it for RCU freeing (Read-Copy-Update, a synchronization mechanism), but it only clears pointers in the out chunk list. This leaves the queued control chunk with a dangling pointer. When an ASCONF ACK clears the suppression and the chunk is transmitted, the kernel dereferences the stale pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.