EUVD-2026-64524
GHSA-5vmc-fx99-r54r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Triggerable by a keyed SCTP peer (PR:L) over the network but gated by a multi-CPU timing race (AC:H); demonstrated impact is kernel crash (A:H) with only speculative memory-corruption C/I (L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix use-after-free of cached ASCONF chunk
addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer.
However, sctp_asconf_queue_teardown() releases the cached chunk without clearing addip_last_asconf. During peer restart handling, sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes sctp_asconf_queue_teardown() while the association remains alive and leaves the pointer dangling.
A delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(), which accesses the stale chunk and passes it to sctp_process_asconf_ack(), causing a use-after-free and a second release.
Clearing the pointer exposes a race with T4 expiry. Peer restart handling queues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses timer_delete(), which does not wait for a callback already running on another CPU. Such a callback can reach sctp_sf_t4_timer_expire() after the purge and dereference NULL.
Clear addip_last_asconf after releasing the cached chunk, and make sctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding ASCONF remains.
AnalysisAI
Use-after-free and NULL-pointer dereference in the Linux kernel's SCTP stack allow a remote SCTP peer to corrupt kernel memory or crash the host by triggering association-restart handling that leaves the cached ASCONF chunk pointer (addip_last_asconf) dangling. A delayed authenticated ASCONF-ACK then reaches sctp_sf_do_asconf_ack() and operates on freed memory, causing a second release, while clearing the pointer exposes a companion NULL dereference via a racing T4 timer callback. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an established SCTP association with the SCTP-AUTH (RFC 4895) extension active, because the triggering ASCONF-ACK is authenticated; requires the dynamic address reconfiguration (ASCONF, RFC 5061 / net.sctp knobs) feature to be in use; and requires driving peer-restart handling (duplicate COOKIE-ECHO into sctp_sf_do_dupcook_a) to queue SCTP_CMD_PURGE_ASCONF_QUEUE while the association stays alive. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict sharply and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who is (or can impersonate a keyed) SCTP peer establishes an association using the AUTH extension, then triggers restart handling (a duplicate COOKIE-ECHO) while an ASCONF chunk is still cached; a deliberately delayed authenticated ASCONF-ACK arrives after the queue purge and is processed against the freed chunk. The resulting use-after-free/double-free or the racing NULL-deref in the T4 timer path panics the kernel, and - less reliably - could be groomed toward kernel memory corruption. … |
| Remediation | Vendor-released patch: upgrade to a fixed stable kernel - 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2 (or your distribution's backport referencing CVE-2026-74587), which clears addip_last_asconf after releasing the cached chunk and makes sctp_sf_t4_timer_expire() consume a stale T4 expiry when no ASCONF is outstanding; apply the matching stable commit from https://git.kernel.org/stable/c/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production systems with SCTP enabled by reviewing kernel configurations and active network connections. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today