Critical 9.8Published Aug 22, 2026

CVE-2026-74688sctp: clear control chunk transport if it is being removed

Updated under an hour ago (Oct 27, 2026, 12:30 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately. If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer. Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free. Fix this by also clearing chunk->transport for queued control chunks in control_chunk_list when removing the transport.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before fad4766a74220fe579c6fcaa10ba01c23529814f; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before 936658ec41c28c397ef390140e02d4c91ade92f0; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before 8de65194a04d2552cd39b6c67d942d490f22d174; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before 6160e756db81d6cb63e3e2952efcf6c5134be385; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before 18d704bdd809377dfd81a3c2f42426763b5da227; 8a07eb0a50aebc8c95478d49c28c7f8419a26cef builds before 4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7; from 8a07eb0a50aebc8c95478d49c28c7f8419a26cef before c9158ceaf27780ef64534ad72f44ffde3f8ccc49	CNA record

References

References

https://git.kernel.org/stable/c/dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886
https://git.kernel.org/stable/c/fad4766a74220fe579c6fcaa10ba01c23529814f
https://git.kernel.org/stable/c/936658ec41c28c397ef390140e02d4c91ade92f0
https://git.kernel.org/stable/c/8de65194a04d2552cd39b6c67d942d490f22d174
https://git.kernel.org/stable/c/6160e756db81d6cb63e3e2952efcf6c5134be385
https://git.kernel.org/stable/c/18d704bdd809377dfd81a3c2f42426763b5da227
https://git.kernel.org/stable/c/4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7
https://git.kernel.org/stable/c/c9158ceaf27780ef64534ad72f44ffde3f8ccc49

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.