{"apiVersion":"1.0","identifier":"CVE-2026-74588","description":"In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport-s transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport-s list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a slab-use-after-free read in sctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the removal and the SACKs come from the association peer. Set chunk->transport at the move. The ordinary resend path needs nothing: it reaches its list_move_tail() only after sctp_packet_append_chunk() returned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the chunk by then. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>","publishedAt":"2026-08-22T16:16:30","lastModifiedAt":"2026-08-25T06:18:33","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74588","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.005,"riskScore":1.02,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74588","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74588","en":"https://www.redsauce.net/en/cves/CVE-2026-74588","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74588","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74588","de":"https://www.redsauce.net/de/cves/CVE-2026-74588","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74588","el":"https://www.redsauce.net/el/cves/CVE-2026-74588"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74588"}}