CVE-2026-64564

Debian 13 6.12.95 SCTP ASCONF DEL-IP UAF 概念验证。 root@kitploit: gcc -O2 -static -o lpe lpedebian.6.12.95.c ./lpe...

sctphantom

SCTPhantom — Linux 内核 SCTP ASCONF use-after-free 跟踪站点 SCTPhantom 补丁状态跟踪器的源码：一个单页站点，记录哪些发行版已为 Linux 内核中的 SCTP ASCONF 传输 use-after-free 漏洞发布了修复。 事实信息所在 关于该漏洞的一切——CVE 编号、受影响与已修复版本、上游修复提交、发现与公开致谢，以及当前各发行版的补丁状态——都属于跟踪页面，而非本 README： 呈现页面： https://kimmo.cloud/sctphantom/ 源码： site/content/index.md...

CVE-2026-74586

CVE-2026-74586 — SCTP ASCONF newtransport 释放后使用触发程序 一个自包含、无需特权的 CVE-2026-74586 PoC，该漏洞是 Linux 内核 SCTP ASCONF（动态地址重配置）处理中的释放后使用问题。漏洞本身的功劳归于 Qing Ming，他向上游报告了该问题；修复提交为 beb33f8ee1ca（“sctp: clear newtransport when removing a peer”），于 2026-08-12 合并并带有 Cc: stable 标记——Red Hat 将其评级为重要，第三方跟踪器将其评为 CVSS 9.8...

EUVD-2026-64524

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctpasconfqueueteardown...

PT-2026-79592

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip last asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp asconf queue teardown...

EUVD-2026-52605

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the transport the ASCONF chunk is processed against in asconf-transport == chunk-transport, set once in sctprcv. For an ASCONF located...