---
id: CVE-2026-74688
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sctp: clear control chunk transport if it is being removed

  sctp_make_heartbeat_ack() caches the destination transport in
  chunk->transport without taking a reference
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sctp: clear control chunk transport if it is being removed

  sctp_make_heartbeat_ack() caches the destination transport in
  chunk->transport without taking a reference. W…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74688'
references:
  - url: 'https://git.kernel.org/stable/c/18d704bdd809377dfd81a3c2f42426763b5da227'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6160e756db81d6cb63e3e2952efcf6c5134be385'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8de65194a04d2552cd39b6c67d942d490f22d174'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/936658ec41c28c397ef390140e02d4c91ade92f0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c9158ceaf27780ef64534ad72f44ffde3f8ccc49'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fad4766a74220fe579c6fcaa10ba01c23529814f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.005
epssPercentile: 0.41132
ingestedAt: '2026-10-14T13:30:58.538Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear control chunk transport if it is being removed

sctp_make_heartbeat_ack() caches the destination transport in
chunk->transport without taking a reference. When src_out_of_asoc_ok is
enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead
of being transmitted immediately.

If the peer transport is removed while the chunk is still queued,
sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing,
but only clears cached transport pointers in out_chunk_list.  The queued
control chunk therefore retains a dangling transport pointer.

Once an ASCONF_ACK clears the suppression and the queued control chunk is
transmitted, SCTP dereferences the stale transport pointer, leading to a
use-after-free.

Fix this by also clearing chunk->transport for queued control chunks in
control_chunk_list when removing the transport.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.