What is the CVSS score of CVE-2026-74688?

CVE-2026-74688 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74688?

CVE-2026-74688 is a critical kernel vulnerability in Linux SCTP that could enable remote code execution on affected systems; while no active exploitation is currently documented, organizations…. A patch is available.

How to fix or mitigate CVE-2026-74688?

Within 24 hours, identify all Linux systems where SCTP is enabled and obtain the vendor patch version for your deployed kernel releases. Within 7 days, deploy the available patch to test and staging environments to validate stability with your SCTP-dependent workloads. Within 30 days, complete rollout of the vendor-released patch to all affected production systems, prioritizing systems with high availability requirements or public-facing SCTP services.

Linux Kernel CVE-2026-74688

EUVD-2026-64375 CRITICAL

2026-08-22 Linux

GHSA-3vfv-7x6v-8jg6

Information Disclosure Linux

9.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remotely reachable via an SCTP peer (AV:N, PR:N) but gated on a teardown-versus-transmit race and non-default SCTP/ASCONF configuration, so AC:H; kernel UAF yields high C/I/A potential.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 25, 2026 - 07:12 vuln.today

CVSS changed

Aug 25, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 22, 2026 - 16:01 EUVD

CVE Published

Aug 22, 2026 - 15:32 cve.org

CRITICAL 9.8

CVE Published

Aug 22, 2026 - 15:32 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear control chunk transport if it is being removed

sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately.

If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer.

Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free.

Fix this by also clearing chunk->transport for queued control chunks in control_chunk_list when removing the transport.

AnalysisAI

Use-after-free in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem allows a remote peer to trigger a dangling transport-pointer dereference on the control chunk queue. The flaw arises because sctp_make_heartbeat_ack() caches a destination transport in chunk->transport without holding a reference; when src_out_of_asoc_ok keeps a HEARTBEAT ACK queued and the peer transport is later torn down, the queued chunk retains a stale pointer that is dereferenced on eventual transmission. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Establish SCTP association with target

Delivery

Trigger address reconfiguration (ASCONF)

Exploit

Force HEARTBEAT ACK queued via suppression

Install

Cause peer transport removal (freed via RCU)

Send ASCONF_ACK to flush queued chunk

Execute

Kernel dereferences stale transport

Impact

Use-after-free crash or memory corruption

Recon

Establish SCTP association with target

Delivery

Trigger address reconfiguration (ASCONF)

Exploit

Force HEARTBEAT ACK queued via suppression

Install

Cause peer transport removal (freed via RCU)

Send ASCONF_ACK to flush queued chunk

Execute

Kernel dereferences stale transport

Impact

Use-after-free crash or memory corruption

Vulnerability AssessmentAI

Exploitation	Requires that the target has the SCTP module loaded and an SCTP association reachable to the attacker, plus SCTP dynamic address reconfiguration (ASCONF/ASCONF_ACK) activity and the src_out_of_asoc_ok delayed-transmission path that keeps a HEARTBEAT ACK queued on control_chunk_list. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are conflicting and warrant a nuanced read. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker establishes an SCTP association with a target host that has SCTP and dynamic address reconfiguration in use, then manipulates path/address state so that a HEARTBEAT ACK stays queued (via the src_out_of_asoc_ok suppression) while the associated peer transport is torn down. A subsequent ASCONF_ACK lifts the suppression and the kernel transmits the queued chunk, dereferencing the freed transport and triggering a use-after-free - most likely crashing the kernel (DoS) and potentially enabling memory disclosure or corruption. …
Remediation	Vendor-released patch: upgrade to a fixed stable kernel for your branch - 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2 (or later), or apply the corresponding stable commit from git.kernel.org/stable (e.g. … Detailed patch versions, workarounds, and compensating controls in full report.