Executive brief
The Linux kernel's SCTP protocol implementation contains a flaw in how it manages data chunks during network transmission. When a peer is removed from a connection, a dangling pointer can remain in a data chunk, causing the kernel to access freed memory when processing acknowledgments. This can lead to system crashes or potential code execution.
Technical details
A use-after-free vulnerability exists in net/sctp/outqueue.c where __sctp_outq_flush_rtx() moves a gap-acked chunk to another transport's transmitted list without updating the chunk->transport pointer. If the original transport is freed (via sctp_assoc_rm_peer() during ASCONF Delete-IP), the chunk retains a dangling pointer. When a subsequent SACK that reneges on the TSN clears the tsn_gap_acked flag, the code accesses the freed transport object in sctp_check_transmitted(), triggering a slab-use-after-free read detected by KASAN. The fix updates chunk->transport during the list move operation. This affects all Linux kernel versions since 2.6.12-rc2.
Affected products
- Linux Linux kernel 2.6.12-rc2 and later (all maintained versions through 6.x and beyond)
Timeline
- 2026-08-22: disclosed: CVE published
- 2026-08-19: patched: Fix merged into stable kernel trees