CRITICAL Introduced in 3.1
sctp HeartbeatAck UAF
CVE-2026-74688
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately. If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer. Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free. Fix this by also clearing chunk->transport for queued control chunks in control_chunk_list when removing the transport.
02KernelScan AI Analysis
Risk summary
A remote attacker who can establish an SCTP association with a vulnerable host can trigger a use-after-free in the kernel's SCTP stack by manipulating HEARTBEAT and ASCONF chunk timing. This can lead to kernel memory corruption, potentially enabling code execution, information disclosure, or a system crash. Any system with the SCTP stack enabled and reachable on the network is at risk.
Vulnerability analysis
When the SCTP stack creates a HEARTBEAT ACK chunk, it caches a pointer to the destination transport without taking a reference. Under certain ASCONF conditions the chunk may remain queued on a control list instead of being sent immediately. If the peer transport is then removed, the cleanup code clears dangling transport pointers on the main output queue but misses the control chunk list, leaving the queued chunk with a stale pointer. When the chunk is eventually transmitted after ASCONF ACK processing, the freed transport is dereferenced, causing a use-after-free. The fix extends the transport removal cleanup to also clear cached transport pointers for chunks on the control chunk list. This vulnerability is reachable by any network peer that can establish an SCTP association with the target host; no local privileges or special hardware are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.1 | 5.10.265 | dbb3f418a866 |
| 5.15 | 3.1 | 5.15.216 | fad4766a7422 |
| 6.1 | 3.1 | 6.1.183 | 936658ec41c2 |
| 6.12 | 3.1 | 6.12.104 | 6160e756db81 |
| 6.18 | 3.1 | 6.18.45 | 18d704bdd809 |
| 6.6 | 3.1 | 6.6.152 | 8de65194a04d |
| 7.1 | 3.1 | 7.1.9 | 4d6b9cac6df5 |
| mainline | 3.1 | 7.2 | c9158ceaf277 |
| cip/4.19 | 3.1 | 4.19.325-cip136 | f5043c643f8c |
| cip/4.19-rt | 3.1 | 4.19.325-cip136-rt50 | f5043c643f8c |
| cip/4.4 | 3.1 | 4.4.302-cip115 | cbe4c1be3d60 |
| cip/4.4-rt | 3.1 | 4.4.302-cip115-rt63 | cbe4c1be3d60 |
| cip/5.10 | 3.1 | 5.10.268-cip77 | dbb3f418a866 |
| cip/5.10-rt | 3.1 | 5.10.268-cip77-rt34 | dbb3f418a866 |
| cip/6.1 | 3.1 | 6.1.187-cip60 | 936658ec41c2 |
| cip/6.1-rt | 3.1 | 6.1.189-cip61-rt32 | 936658ec41c2 |
| cip/6.12 | 3.1 | 6.12.104-cip30 | 6160e756db81 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |
| cip/4.4 | Fixed in 4.4.302-cip115 |
| cip/4.4-rt | Fixed in 4.4.302-cip115-rt63 |