EUVD-2026-64375

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the destination transport in chunk-transport without taking a reference. When srcoutofasocok is enabled, the HEARTBEAT ACK may remain queued o...

CVE-2026-74588 sctp: keep chunk->transport in step with the list it is queued on

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsngapacked...

CVE-2026-74588 sctp: keep chunk->transport in step with the list it is queued on

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsngapacked...

CVE-2026-74587 sctp: fix use-after-free of cached ASCONF chunk

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctpasconfqueueteardown...

CVE-2026-74587

A use-after-free vulnerability exists in the Linux kernel SCTP implementation. During peer restart handling, sctp_asconf_queue_teardown() releases the cached ASCONF chunk without clearing the addip_last_asconf pointer, leaving it dangling. A remote attacker can exploit this by sending a delayed a...

CVE-2026-74587 sctp: fix use-after-free of cached ASCONF chunk

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctpasconfqueueteardown...

Linux Distros Unpatched Vulnerability : CVE-2026-74587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the...

Linux Distros Unpatched Vulnerability : CVE-2026-74688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the destination transport in chunk-transport without taking a reference...

PT-2026-79693

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp make heartbeat ack caches the destination transport in chunk-transport without taking a reference. When src out of asoc ok is enabled, the HEARTBEAT ACK may remain...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102029)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102029 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a...

CVE-2026-72398

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. When cookie authentication is disabled, a remote attacker can tamper with the INIT chunk data during the SCTP handshake. This occurs because the reconstructed INIT chunk from the COOKIE-ECHO...

USN-8650-1: Cap'n Proto vulnerabilities

Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly handled negative Content-Length values or excessively large chunk sizes when processing HTTP messages. An attacker could possibly use these issues to cause HTTP messages to be interpreted inconsistently, resulting in HTTP request ...

USN-8650-1 capnproto vulnerabilities

Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly handled negative Content-Length values or excessively large chunk sizes when processing HTTP messages. An attacker could possibly use these issues to cause HTTP messages to be interpreted inconsistently, resulting in HTTP request ...

Exploit for CVE-2026-64564

CVE-2026-64564: SCTPhantom - Local Privilege Escalation LPE...

EUVD-2026-59631

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

CVE-2026-74566 keys: make keyring key-chunk byte order agree with keyring_diff_objects()

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

CVE-2026-72398

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

CVE-2026-72398 sctp: add INIT verification after cookie unpacking

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

CVE-2026-72398 sctp: add INIT verification after cookie unpacking

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

PT-2026-72601

In the Linux kernel, the following vulnerability has been resolved: sctp: fix err chunk memory leaks in INIT handling When sctp verify init encounters unrecognized parameters, it allocates an err chunk to report them. However, this chunk is leaked in several code paths: 1. In sctp sf do 5 1B init...