9.8

CVE-2026-74587: linux

CVSS: 9.8v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-74587DEBIAN-CVE-2026-74587
Published 22-08-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-74587 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.5% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.50%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 6
MGASA-2026-0506USN-8875-1USN-8875-2USN-8877-1USN-8878-1USN-8879-1

Timeline

  1. 22-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp_asconf_queue_teardown() releases the cached chunk without clearing addip_last_asconf. During peer restart handling, sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes sctp_asconf_queue_teardown() while the association remains alive and leaves the pointer dangling. A delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(), which accesses the stale chunk and passes it to sctp_process_asconf_ack(), causing a use-after-free and a second release. Clearing the pointer exposes a race with T4 expiry. Peer restart handling queues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses timer_delete(), which does not wait for a callback already running on another CPU. Such a callback can reach sctp_sf_t4_timer_expire() after the purge and dereference NULL. Clear addip_last_asconf after releasing the cached chunk, and make sctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding ASCONF remains.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.50%

Chance of exploitation in the next 30 days

Percentile

42%

Versus all other CVEs

30-day change

0.00 pp

From 0.50% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.50%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.9-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ a000c01e60e40e15304ffe48fff051d17a7bea91, < 10459b03e2d9ee12435e96f587de4d4cacdbf435 | ≥ a000c01e60e40e15304ffe48fff051d17a7bea91, < e1bb114e09372fd6e03387ced9ef566da336ed6c | ≥ a000c01e60e40e15304ffe48fff051d17a7bea91, < 179676f0166230c80053a392303485b37c93dd33 | ≥ a000c01e60e40e15304ffe48fff051d17a7bea91, < dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d | ≥ a000c01e60e40e15304ffe48fff051d17a7bea91, < 618b5c6d049896fcfabb91afc072954c92cb2693 | ≥ a000c01e60e40e15304ffe48fff051d17a7bea91, < 07daf4f9750104960a1d60831b2353c0d41f35fb | ≥ a000c01e60e40e15304ffe48fff051d17a7bea91, < d949992bc3f00027a2c755e860a11950c75f6073 | ≥ a000c01e60e40e15304ffe48fff051d17a7bea91, < 8c283e7b56adce00193837f3311b06662466fb21 | 3.0

3 vendors · 172 products

References

18 links
Show all 18 references