CVE-2026-74688: Linux Kernel SCTP Use-After-Free Vulnerability

CVE-2026-74688 Overview

CVE-2026-74688 is a use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in the handling of control chunks queued on control_chunk_list. Specifically, sctp_make_heartbeat_ack() caches a destination transport in chunk->transport without incrementing its reference count. When a peer transport is removed while a HEARTBEAT ACK remains queued, the chunk retains a dangling pointer. Once transmission resumes, the kernel dereferences freed memory. Successful exploitation may allow remote attackers to corrupt kernel memory, trigger denial of service, or achieve code execution in kernel context.

Critical Impact
Remote, unauthenticated attackers can trigger a kernel use-after-free over SCTP, potentially leading to kernel memory corruption and privilege escalation.

Affected Products

Linux kernel branches containing the SCTP sctp_make_heartbeat_ack() control chunk caching logic
Distributions shipping affected upstream kernels prior to the referenced stable patches
Systems with SCTP module loaded and reachable network services using SCTP

Discovery Timeline

2026-08-22 - CVE-2026-74688 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74688

Vulnerability Analysis

The vulnerability exists in the Linux kernel SCTP stack. The function sctp_make_heartbeat_ack() stores a pointer to the destination transport structure in chunk->transport without taking a reference on that transport. Under normal operation, the HEARTBEAT ACK is transmitted immediately and the cached pointer never outlives the transport.

However, when src_out_of_asoc_ok is enabled, the HEARTBEAT ACK can remain queued on the association's control_chunk_list rather than being sent right away. During this queued state, the transport pointed to by the chunk may be dismantled by sctp_assoc_rm_peer() if the peer is removed from the association.

sctp_assoc_rm_peer() drops the transport and schedules it for release via read-copy-update (RCU), but only clears cached transport pointers in out_chunk_list. Chunks queued on control_chunk_list are missed, leaving stale pointers behind. When an ASCONF_ACK later clears the transmission suppression, the queued chunk is dequeued and processed, and the kernel dereferences a freed transport, producing a use-after-free.

Root Cause

The root cause is inconsistent cleanup of cached transport pointers when a peer transport is removed. sctp_assoc_rm_peer() sanitizes out_chunk_list but does not walk control_chunk_list, so queued control chunks retain dangling references to RCU-freed memory.

Attack Vector

Exploitation requires that a remote peer be able to establish an SCTP association and trigger sequences that produce a queued HEARTBEAT ACK followed by removal of the associated peer transport and eventual delivery of an ASCONF_ACK. Because SCTP is a network-facing protocol, the attack does not require local access or authentication on the target host.

No verified public exploit is available. See the referenced kernel commits for technical details of the fix: Kernel Patch 18d704b, Kernel Patch 4d6b9ca, and Kernel Patch fad4766.

Detection Methods for CVE-2026-74688

Indicators of Compromise

Kernel Oops, general protection fault, or KASAN use-after-free reports referencing sctp_make_heartbeat_ack, sctp_outq_flush, or control_chunk_list
Unexpected kernel panics on hosts exposing SCTP endpoints (for example, Diameter, SS7, or M3UA services)
Anomalous SCTP traffic combining HEARTBEAT ACKs, ASCONF, and ASCONF_ACK chunks from untrusted peers

Detection Strategies

Enable KASAN on test kernels to surface use-after-free access patterns in the SCTP subsystem
Correlate kernel log entries (dmesg, journalctl -k) with SCTP association teardown events
Monitor for repeated crashes or reboots on telecom, VoIP, or clustering nodes that terminate SCTP

Monitoring Recommendations

Alert on kernel oops or BUG traces referencing SCTP symbols across the fleet
Track SCTP association churn and unexpected peer removals via ss --sctp and netlink telemetry
Ingest kernel and network telemetry into a centralized analytics platform for cross-host pattern detection

How to Mitigate CVE-2026-74688

Immediate Actions Required

Apply the upstream stable kernel patches referenced by the CVE to all affected hosts
If patching is not immediately possible, unload the SCTP module (modprobe -r sctp) on systems that do not require it
Restrict SCTP exposure to trusted peers via firewall rules on protocol 132
Audit which workloads depend on SCTP (telecom signaling, clustering, WebRTC data channels) before disabling

Patch Information

The upstream fix clears chunk->transport for queued control chunks in control_chunk_list when the associated transport is removed by sctp_assoc_rm_peer(). Distribution kernels should be updated to include the fixes referenced in Kernel Patch 6160e75, Kernel Patch 8de6519, Kernel Patch 936658e, Kernel Patch c9158ce, and Kernel Patch dbb3f41.

Workarounds

Blacklist the SCTP kernel module on hosts that do not require the protocol
Block inbound and outbound IP protocol 132 at perimeter and host firewalls where SCTP is not needed
Segment SCTP-dependent workloads onto dedicated hosts with strict peer allowlists

bash

# Disable and blacklist the SCTP kernel module on hosts that do not require it
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo modprobe -r sctp

# Block SCTP (IP protocol 132) at the host firewall
sudo iptables -A INPUT  -p 132 -j DROP
sudo iptables -A OUTPUT -p 132 -j DROP