CVE-2026-74587 sctp: fix use-after-free of cached ASCONF chunk

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctpasconfqueueteardown...

EUVD-2026-64524

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctpasconfqueueteardown...

EUVD-2026-64523

In the Linux kernel, the following vulnerability has been resolved: sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCONF chunk have been processed, sctpsfdoasconf uses this pointer to send...

CVE-2026-74587

A use-after-free vulnerability exists in the Linux kernel SCTP implementation. During peer restart handling, sctp_asconf_queue_teardown() releases the cached ASCONF chunk without clearing the addip_last_asconf pointer, leaving it dangling. A remote attacker can exploit this by sending a delayed a...

CVE-2026-74587 sctp: fix use-after-free of cached ASCONF chunk

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctpasconfqueueteardown...

CVE-2026-74586

CVE-2026-74586 is a use-after-free in the Linux kernel's SCTP subsystem. When an authenticated remote SCTP peer sends an ASCONF that both adds and removes a transport (via wildcard DEL-IP) in the same chunk, asoc->new_transport is left pointing to the freed transport without a reference held. ...

CVE-2026-74586 sctp: clear new_transport when removing a peer

In the Linux kernel, the following vulnerability has been resolved: sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCONF chunk have been processed, sctpsfdoasconf uses this pointer to send...

SUSE-SU-2026:3701-1 Security update for the Linux Kernel RT (Live Patch 17 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.62 fixes various security issues: The following security issues were fixed: - CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024. -...

SUSE-SU-2026:3696-1 Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.34 fixes various security issues: The following security issues were fixed: - CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024. -...

SUSE-SU-2026:3694-1 Security update for the Linux Kernel RT (Live Patch 14 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.51 fixes various security issues: The following security issues were fixed: - CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024. -...

SUSE-SU-2026:3689-1 Security update for the Linux Kernel RT (Live Patch 3 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.13 fixes various security issues: The following security issues were fixed: - CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024. -...

Linux Distros Unpatched Vulnerability : CVE-2026-74586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCON...

PT-2026-79591

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the SCTP implementation of the Linux kernel. An authenticated remote SCTP peer can trigger this by sending an ASCONF chunk that simultaneously adds ...

Linux Distros Unpatched Vulnerability : CVE-2026-74587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the...

PT-2026-79592

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip last asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp asconf queue teardown...

Linux Distros Unpatched Vulnerability : CVE-2026-74624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid...

Linux Distros Unpatched Vulnerability : CVE-2026-74688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the destination transport in chunk-transport without taking a reference...

PT-2026-79629

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlink log and conntrack export is enabled,...

Linux Distros Unpatched Vulnerability : CVE-2026-74588

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap- acked chunk onto another transport's transmitted list without...

PT-2026-79693

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp make heartbeat ack caches the destination transport in chunk-transport without taking a reference. When src out of asoc ok is enabled, the HEARTBEAT ACK may remain...