In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on… (CVE-2026-74588)
A use-after-free vulnerability in the Linux kernel SCTP implementation was resolved. The issue involved a chunk's transport pointer becoming stale after being moved between transport lists, leading to a dangling pointer. This could cause a kernel slab-use-after-free read when processing certain SCTP packets. The vulnerability was discovered and fixed by ensuring the chunk's transport pointer is updated correctly when moved.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel SCTP subsystem occurred because __sctp_outq_flush_rtx() moved a gap-acked chunk onto another transport's transmitted list without updating the chunk->transport pointer. If the original transport was removed and freed, the chunk retained a dangling pointer to the freed transport. Subsequent SCTP SACK processing could dereference this stale pointer, causing a use-after-free read detected by KASAN. The fix involved updating chunk->transport at the time of the list move to keep it in sync with the list it is queued on.
Potential Impact
This vulnerability can lead to a kernel use-after-free condition, which may cause system instability or crashes. There is no evidence of known exploits in the wild. The impact is limited to the SCTP protocol handling in the Linux kernel and requires specific SCTP packet sequences to trigger.
Mitigation Recommendations
A fix has been implemented to update the chunk->transport pointer correctly when moving chunks between transport lists. Users should apply the official Linux kernel patches that address this issue once available. Patch status is not yet confirmed from vendor advisories; check the Linux kernel security advisories for updates.
In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on… (CVE-2026-74588)
Description
A use-after-free vulnerability in the Linux kernel SCTP implementation was resolved. The issue involved a chunk's transport pointer becoming stale after being moved between transport lists, leading to a dangling pointer. This could cause a kernel slab-use-after-free read when processing certain SCTP packets. The vulnerability was discovered and fixed by ensuring the chunk's transport pointer is updated correctly when moved.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel SCTP subsystem occurred because __sctp_outq_flush_rtx() moved a gap-acked chunk onto another transport's transmitted list without updating the chunk->transport pointer. If the original transport was removed and freed, the chunk retained a dangling pointer to the freed transport. Subsequent SCTP SACK processing could dereference this stale pointer, causing a use-after-free read detected by KASAN. The fix involved updating chunk->transport at the time of the list move to keep it in sync with the list it is queued on.
Potential Impact
This vulnerability can lead to a kernel use-after-free condition, which may cause system instability or crashes. There is no evidence of known exploits in the wild. The impact is limited to the SCTP protocol handling in the Linux kernel and requires specific SCTP packet sequences to trigger.
Mitigation Recommendations
A fix has been implemented to update the chunk->transport pointer correctly when moving chunks between transport lists. Users should apply the official Linux kernel patches that address this issue once available. Patch status is not yet confirmed from vendor advisories; check the Linux kernel security advisories for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g275-m9xc-x5q2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-74588"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8a27f3acd9273b499bc8b4
Added to database: 08/22/2026, 22:51:31 UTC
Last enriched: 08/22/2026, 23:10:27 UTC
Last updated: 08/23/2026, 01:50:21 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.