EUVD-2026-64525
GHSA-g275-m9xc-x5q2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote peer with no auth (PR:N) but AC:H for the required ASCONF Delete-IP plus renege/SACK race on non-default SCTP ADD-IP config; realistic impact is a kernel crash (A:H), with C/I unproven.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
sctp: keep chunk->transport in step with the list it is queued on
__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport:
if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; }
The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither.
The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches
tchunk->transport->flight_size -= sctp_data_size(tchunk);
inside the freed transport. KASAN reports a slab-use-after-free read in sctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the removal and the SACKs come from the association peer.
Set chunk->transport at the move. The ordinary resend path needs nothing: it reaches its list_move_tail() only after sctp_packet_append_chunk() returned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the chunk by then.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
AnalysisAI
Denial of service (and potential memory corruption) in the Linux kernel SCTP stack arises because __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport, leaving a dangling pointer once the original transport is RCU-freed via an ASCONF Delete-IP peer removal. A subsequent SACK that reneges the TSN clears tsn_gap_acked, and the next SACK dereferences the freed transport in sctp_check_transmitted(), producing a KASAN-confirmed slab-use-after-free. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to actively use SCTP with an established association, and the SCTP dynamic address reconfiguration (ASCONF / ADD-IP) extension enabled so an ASCONF Delete-IP can drive sctp_assoc_rm_peer() to free a transport (net.sctp.addip_enable, which is disabled by default on stock kernels). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict sharply here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker acting as (or hijacking) the remote peer of an established SCTP association sends an ASCONF Delete-IP to remove one of the local host's peer transports, causing that transport to be RCU-freed while a gap-acked chunk still points to it. The peer then transmits a SACK that reneges the affected TSN followed by another SACK, driving the kernel to dereference the freed transport in sctp_check_transmitted() and triggering a use-after-free that crashes the kernel. … |
| Remediation | Vendor-released patch: upgrade to a fixed kernel - 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2 (or later) matching your series, applying the commit that sets chunk->transport at the list move (see the git.kernel.org stable commits listed for CVE-2026-74588). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems actively using SCTP with dynamic address reconfiguration (ASCONF Delete-IP operations), prioritizing production infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today