CVE-2026-74586: Linux Kernel SCTP Use-After-Free Vulnerability

CVE-2026-74586 Overview

CVE-2026-74586 is a use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in sctp_process_asconf_param(), which stores a newly added peer transport in asoc->new_transport without clearing the pointer when the transport is subsequently removed within the same ASCONF chunk.

An authenticated remote SCTP peer can add and then remove a transport using a wildcard DEL-IP parameter. The stale pointer is later dereferenced by sctp_outq_select_transport(), producing a slab use-after-free confirmed by KASAN reports on net/sctp/outqueue.c:833.

Critical Impact
An authenticated remote peer can trigger kernel memory corruption in SCTP, leading to potential remote code execution or kernel panic on affected Linux systems.

Affected Products

Linux kernel (mainline, prior to the patch commits listed in kernel.org stable references)
Linux stable kernel branches receiving backports 163847552a57, 291accf36feb, 31efa656cf6a, 3b539b317cd0, beb33f8ee1ca, c0f973bb5118, ca33df36aa01, and db9d8e3b670f
Any Linux distribution shipping unpatched SCTP with authenticated ASCONF enabled

Discovery Timeline

2026-08-22 - CVE-2026-74586 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74586

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the SCTP subsystem triggered during processing of authenticated ASCONF chunks. sctp_process_asconf_param() records newly added peer transports in asoc->new_transport so that sctp_sf_do_asconf() can send a HEARTBEAT to that transport after all parameters have been processed.

When a single ASCONF chunk contains both an add-IP parameter and a wildcard DEL-IP parameter, sctp_assoc_del_nonprimary_peers() removes the newly added transport but preserves the transport on which the ASCONF arrived. The removal path never clears asoc->new_transport, leaving it pointing at freed memory.

sctp_sf_do_asconf() then constructs a HEARTBEAT chunk whose chunk->transport references the removed transport, without taking a reference. During local address replacement, src_out_of_asoc_ok keeps the HEARTBEAT queued on control_chunk_list. After the transport is freed by RCU, a successful ASCONF_ACK for the replacement address releases the queued HEARTBEAT and sctp_outq_select_transport() reads transport->state from freed memory.

Root Cause

The root cause is a missing pointer invalidation. sctp_assoc_del_nonprimary_peers() does not reset asoc->new_transport when it frees the associated transport, breaking the invariant assumed by sctp_sf_do_asconf().

Attack Vector

An authenticated remote SCTP peer sends a crafted ASCONF chunk that both adds a new peer address and issues a wildcard DEL-IP against the association. The subsequent HEARTBEAT and local address replacement sequence triggers the four-byte read at net/sctp/outqueue.c:833 against freed transport memory.

The vulnerability manifests in the SCTP ASCONF parameter processing path. See the kernel.org patch commit 163847552a57 for the exact source-level fix.

Detection Methods for CVE-2026-74586

Indicators of Compromise

KASAN slab-use-after-free reports referencing sctp_outq_select_transport, sctp_outq_flush, or sctp_process_asconf_ack in kernel logs
Unexpected kernel oops or panic traces originating from the sctp module during ASCONF processing
Authenticated SCTP peers sending ASCONF chunks containing both add-IP and wildcard DEL-IP parameters in a single chunk

Detection Strategies

Enable KASAN on test and staging kernels to catch the use-after-free deterministically during fuzzing or regression runs
Monitor kernel ring buffer output via dmesg and centralized log collectors for stack traces containing sctp_transport_immediate_rtx and sctp_process_asconf_ack
Inspect packet captures on SCTP-enabled hosts for ASCONF chunks combining add-IP and wildcard address delete parameters

Monitoring Recommendations

Forward /var/log/kern.log and journald output to a centralized logging platform and alert on any SCTP-module KASAN or BUG entries
Track SCTP association state changes and unusual peer address churn on hosts running telecom, SS7-over-IP, or WebRTC data channel workloads
Baseline expected SCTP ASCONF traffic and alert on ASCONF chunks from unauthenticated or unexpected peers

How to Mitigate CVE-2026-74586

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 163847552a57, 291accf36feb, 31efa656cf6a, 3b539b317cd0, beb33f8ee1ca, c0f973bb5118, ca33df36aa01, and db9d8e3b670f
If SCTP is not required, unload the module with modprobe -r sctp and blacklist it to eliminate the attack surface
Restrict SCTP peers via firewall rules so that only trusted, authenticated hosts can initiate associations

Patch Information

The fix clears asoc->new_transport when the associated peer is removed, ensuring sctp_sf_do_asconf() cannot construct a HEARTBEAT referencing freed memory. Consult the Linux kernel stable tree commit 163847552a57 and the additional backport commits published to kernel.org for distribution-specific integration.

Workarounds

Disable SCTP authentication or the ASCONF extension where operationally feasible to prevent authenticated peers from reaching the vulnerable code path
Blacklist the sctp kernel module on systems that do not require it by adding install sctp /bin/true to /etc/modprobe.d/
Segment SCTP-speaking hosts on isolated network paths and require mutual authentication at the network layer

bash

# Blacklist the SCTP module and confirm it is not loaded
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/blacklist-sctp.conf
sudo modprobe -r sctp 2>/dev/null || true
lsmod | grep -E "^sctp\b" && echo "sctp still loaded" || echo "sctp not loaded"