CVE-2026-64564

Debian 13 6.12.95 SCTP ASCONF DEL-IP UAF proof of concept. gcc -O2 -static -o lpe lpedebian.6.12.95.c ./lpe...

CVE-2026-74586

CVE-2026-74586 — SCTP ASCONF newtransport use-after-free trigger A self-contained, unprivileged PoC for CVE-2026-74586, a use-after-free in the Linux kernel's SCTP ASCONF dynamic address reconfiguration handling. Credit for the bug itself goes to Qing Ming, who reported it upstream; the fix is...

sctphantom

SCTPhantom — Linux kernel SCTP ASCONF use-after-free tracking site Source for the SCTPhantom patch-status tracker: a single-page site recording which distributions have shipped a fix for the SCTP ASCONF transport use-after-free in the Linux kernel. Where the facts live Everything about the bug —...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107260)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107260 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the...

Exploit for CVE-2026-74586

CVE-2026-74586 — SCTP ASCONF newtransport use-after-free trig...

EUVD-2026-64524

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctpasconfqueueteardown...

PT-2026-79592

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the SCTP implementation. The addip last asconf variable caches outbound ASCONF chunks. When sctp asconf queue teardown is called during peer restart...

EUVD-2026-52605

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the transport the ASCONF chunk is processed against in asconf-transport == chunk-transport, set once in sctprcv. For an ASCONF located...