CVE-2026-64564: Linux Kernel SCTP Use-After-Free Flaw

CVE-2026-64564 Overview

CVE-2026-64564 is a use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in sctp_process_asconf() during Address Configuration (ASCONF) DEL-IP processing. A crafted ASCONF chunk can free the transport that the ASCONF is being processed against, leaving asconf->transport as a dangling pointer. Subsequent processing of a wildcard DEL-IP parameter dereferences the freed memory in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(), corrupting the association's primary_path and active_path pointers. The vulnerability has been resolved upstream in the mainline kernel and stable branches.

Critical Impact
A remote SCTP peer can trigger a use-after-free in kernel memory, leading to denial of service or potential memory corruption within the SCTP association state.

Affected Products

Linux kernel SCTP subsystem (net/sctp/sm_make_chunk.c)
Stable kernel branches fixed by commits 74e8f3e, 85aca40, 9b2854f, d136b29, and fedeb44
Distributions shipping unpatched Linux kernels with SCTP enabled

Discovery Timeline

2026-08-04 - CVE-2026-64564 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-64564

Vulnerability Analysis

The SCTP receive path in sctp_rcv() caches the transport associated with an incoming chunk. When sctp_process_asconf() processes an ASCONF chunk located through its Address Parameter by __sctp_rcv_asconf_lookup(), the cached transport in asconf->transport corresponds to the Address Parameter rather than the packet's source address. Existing code in sctp_process_asconf_param() rejects a DEL-IP that targets the packet's source address via the ADDIP D8 guard (SCTP_ERROR_DEL_SRC_IP), but no equivalent protection exists for the transport pointer cached in asconf->transport.

Root Cause

An attacker can build a single ASCONF chunk containing an Address Parameter for address L, followed by a DEL-IP for L, followed by a wildcard DEL-IP (0.0.0.0). The DEL-IP for L bypasses the D8 source-address check and calls sctp_assoc_rm_peer() on the transport still referenced by asconf->transport. That call schedules the transport for RCU-deferred free, but asconf->transport continues to point at the released memory.

Attack Vector

When processing continues to the wildcard DEL-IP, sctp_assoc_set_primary() dereferences the freed transport's ->ipaddr and ->state fields and stores the dangling pointer into asoc->peer.primary_path and active_path. sctp_assoc_del_nonprimary_peers() then removes every real transport from the list while preserving only the stale pointer. The association is left with transport_count of zero and its primary and active paths pointing at freed memory. Any peer capable of sending SCTP ASCONF chunks to a listening endpoint can trigger this condition. See the upstream fix commit for the guard that rejects a DEL-IP targeting the transport the ASCONF is being processed against.

Detection Methods for CVE-2026-64564

Indicators of Compromise

Kernel oops or KASAN: use-after-free splats referencing sctp_assoc_set_primary, sctp_assoc_del_nonprimary_peers, or sctp_process_asconf_param
Sudden loss of SCTP connectivity on an association with transport_count reported as zero
Unexpected SCTP ASCONF chunks arriving from untrusted networks that combine an Address Parameter, a matching DEL-IP, and a wildcard DEL-IP in one packet

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface use-after-free access in the SCTP code path during fuzzing
Add packet capture rules that flag SCTP ASCONF chunks containing multiple DEL-IP parameters, including wildcard addresses
Correlate kernel ring buffer messages (dmesg) with SCTP endpoint state transitions to identify suspicious association teardowns

Monitoring Recommendations

Monitor hosts running telecom, SIGTRAN, or WebRTC data-channel workloads that rely on SCTP for anomalous ASCONF traffic
Alert on kernel crashes originating in net/sctp/ from telemetry collectors and centralized log pipelines
Track deployment of stable kernel versions containing the referenced fix commits across the fleet

How to Mitigate CVE-2026-64564

Immediate Actions Required

Apply the vendor kernel update that includes the upstream fix rejecting DEL-IP against the ASCONF's own transport
Disable the SCTP module on hosts that do not require it by blacklisting sctp in /etc/modprobe.d/
Restrict inbound SCTP traffic at the network perimeter to known, trusted peers only

Patch Information

The issue is resolved by the Linux kernel commits 74e8f3e, 85aca40, 9b2854f, d136b29, and fedeb44. The patch adds a check to reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard.

Workarounds

Blacklist the SCTP kernel module where the protocol is not required: add blacklist sctp to a file under /etc/modprobe.d/ and reboot
Filter SCTP (IP protocol 132) at firewalls or use iptables/nftables rules to drop untrusted ASCONF traffic
Restrict SCTP endpoints to trusted subnets using association-level access controls in application configuration

bash

# Prevent the SCTP module from loading on systems that do not need it
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true

# Block inbound SCTP (protocol 132) at the host firewall
sudo nft add rule inet filter input meta l4proto sctp drop