9.8

CVE-2026-74588: linux

CVSS: 9.8v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-74588DEBIAN-CVE-2026-74588
Published 22-08-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-74588 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.5% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.50%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 16
MGASA-2026-0506OPENSUSE-SU-2026:22091-1SUSE-SU-2026:4639-1SUSE-SU-2026:4640-1SUSE-SU-2026:4660-1SUSE-SU-2026:4665-1

Timeline

  1. 22-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a slab-use-after-free read in sctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the removal and the SACKs come from the association peer. Set chunk->transport at the move. The ordinary resend path needs nothing: it reaches its list_move_tail() only after sctp_packet_append_chunk() returned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the chunk by then. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.50%

Chance of exploitation in the next 30 days

Percentile

42%

Versus all other CVEs

30-day change

0.00 pp

From 0.50% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.50%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.9-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 6575fb17230814b48b471727c8410c0aadff9274 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 6b9e2ea2057113f3393990ba646d2d97c719a80d | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 874a7c2b5e184f06134fdfde27e9ce9271bafe58 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1adf929121e13e0b19200bb9fef715b918d483fe | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e2e7c1de0e226ca1b7fea2de57a6c9bca408709b | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9f2cf069a9a72a2d6b97ca8b4c70e714aac99749 | 2.6.12

3 vendors · 172 products

References

18 links
Show all 18 references