Overview
In the SCTP retransmission path, a chunk that has been gap-acknowledged gets moved to another transport's queue without updating the chunk's own transport pointer. If the peer then removes that original transport with an ASCONF Delete-IP, the kernel frees it while the chunk still points at it.
A later SACK that reneges on the chunk clears the gap-acked flag, and the next SACK follows the dangling pointer into freed memory. Both the removal and the SACKs come from the remote peer. The CVE carries a CVSS score of 9.8. The fix rebinds the chunk's transport at the move.
Affected products
- Linux kernel builds with SCTP before the 22 Aug 2026 stable updates
Disclosure timeline
- 15 Aug 2026
- CVE-2026-74588 reserved
- 22 Aug 2026
- CVE published by the Linux kernel CVE team; stable fixes released