CVE-2026-74587: Linux Kernel SCTP Use-After-Free Vulnerability

CVE-2026-74587 Overview

CVE-2026-74587 is a use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in the handling of cached Address Configuration Change (ASCONF) chunks tracked by the addip_last_asconf pointer. During peer restart handling, sctp_asconf_queue_teardown() releases the cached chunk without clearing the pointer, leaving a dangling reference on a live association.

A delayed authenticated ASCONF-ACK reaching sctp_sf_do_asconf_ack() then dereferences the freed chunk and passes it to sctp_process_asconf_ack(), producing a use-after-free and a second release. A related race with T4 timer expiry can cause a NULL pointer dereference in sctp_sf_t4_timer_expire().

Critical Impact
Remote attackers on an SCTP-reachable network path can trigger memory corruption in the kernel, enabling denial of service and potential code execution with kernel privileges.

Affected Products

Linux kernel builds with SCTP support enabled prior to the fix commits
Distributions shipping affected upstream stable branches
Server and networking systems using SCTP for signaling (e.g., telecom SIGTRAN, diameter, or clustered applications)

Discovery Timeline

2026-08-22 - CVE-2026-74587 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74587

Vulnerability Analysis

SCTP associations cache the most recent outstanding outbound ASCONF chunk in addip_last_asconf so that ASCONF-ACK processing can match responses to requests. Under normal completion, the ACK path frees the chunk and clears the pointer atomically. The teardown path, however, freed the chunk without resetting the pointer.

When a peer restarts, sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes sctp_asconf_queue_teardown() on a still-live association. The dangling pointer then references freed memory. A subsequent authenticated ASCONF-ACK delivered by the peer causes sctp_sf_do_asconf_ack() to read the stale chunk and pass it to sctp_process_asconf_ack(), triggering the use-after-free and a second kfree() on the same object.

A second concurrency issue compounds the flaw. Peer restart queues a T4 timer stop before the purge, but SCTP_CMD_TIMER_STOP uses timer_delete(), which does not wait for a callback already executing on another CPU. That callback can enter sctp_sf_t4_timer_expire() after purge completes and dereference NULL.

Root Cause

The root cause is inconsistent lifetime management of the cached ASCONF chunk [Use After Free]. The teardown routine released the chunk without invalidating addip_last_asconf, and the T4 timer path lacked handling for a stale expiry racing with a purge on another CPU.

Attack Vector

The attack surface is reachable over the network wherever SCTP is exposed. An attacker who can complete an SCTP handshake, trigger a peer-restart sequence via a duplicate COOKIE, and deliver an authenticated ASCONF-ACK can drive the association through the vulnerable state transitions. Successful exploitation corrupts kernel heap state and can escalate to privileged code execution.

No verified public proof-of-concept is available at publication time. See the upstream fixes for technical details, including the primary kernel commit and the T4 timer hardening commit.

Detection Methods for CVE-2026-74587

Indicators of Compromise

Kernel oops or panic traces referencing sctp_process_asconf_ack, sctp_sf_do_asconf_ack, or sctp_sf_t4_timer_expire
KASAN reports of use-after-free or double-free on SCTP chunk allocations
Unexpected SCTP association resets following bursts of COOKIE ECHO and ASCONF-ACK traffic

Detection Strategies

Enable KASAN and SLUB debugging on test kernels to surface UAF conditions in the SCTP path
Monitor dmesg and syslog for stack traces in the net/sctp subsystem, particularly on hosts exposing SCTP ports
Correlate SCTP endpoint restart events with subsequent kernel warnings on the same association

Monitoring Recommendations

Inventory hosts with CONFIG_IP_SCTP enabled and identify which services bind SCTP sockets
Alert on SCTP traffic from untrusted networks reaching kernel endpoints not required for business function
Track kernel package versions across the fleet to confirm patched builds are deployed

How to Mitigate CVE-2026-74587

Immediate Actions Required

Apply the vendor-supplied kernel update that includes the upstream fix as soon as it is available for your distribution
Restrict SCTP exposure at the network perimeter to trusted peers only
Unload or blocklist the sctp kernel module on systems that do not require the protocol

Patch Information

The upstream fix clears addip_last_asconf immediately after releasing the cached chunk and makes sctp_sf_t4_timer_expire() tolerate a stale T4 expiry when no outstanding ASCONF remains. Relevant stable-tree commits include 07daf4f9750, 10459b03e2d, 179676f0166, 618b5c6d049, 8c283e7b56a, d949992bc3f0, dc67d528c2fa, and e1bb114e0937. See the Linux stable kernel git tree for the full patch set.

Workarounds

Blocklist the SCTP module: add install sctp /bin/true to a file under /etc/modprobe.d/ and rebuild the initramfs
Filter SCTP (IP protocol 132) at host and network firewalls where the protocol is not required
Limit SCTP peers using nftables or iptables -p sctp rules to a known allowlist

bash

# Configuration example
# Disable loading of the SCTP module
echo 'install sctp /bin/true' | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true

# Drop inbound SCTP from untrusted networks (protocol 132)
sudo nft add rule inet filter input meta l4proto sctp drop