CVE-2026-64564

sctp: don't free the ASCONF's own transport in DEL-IP processing

Published: Aug 4, 2026Updated: Aug 19, 2026 Sources: CVE List NVD

9.8CRITICAL

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

In plain language

AI Act now

This is a critical flaw in the linux kernel: if your systems accept SCTP network traffic, act urgently because a remote attacker can crash or potentially take control of the service.

Executive summary

Unauthenticated network attack against SCTP ASCONF DEL-IP processing can create a use-after-free condition, causing service disruption or potential code execution.

If affected, business impact

Network service outagePossible system takeoverBusiness application disruptionCustomer data exposureRecovery and downtime costs

What to do now

Check whether your linux kernel systems use SCTP or accept SCTP traffic from untrusted networks.
Ask your operating-system provider for a kernel update that includes the fix for CVE-2026-64564.
Deploy a kernel containing the applicable fix commit: a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293, a63afa1f9b12d5293cbe0b77fd45dc0632533a13, 2b324ba3494ae958cba16a453e3e71489b4de7fc, fedeb4468987bcaff85fe3061de5ae052d414740, 74e8f3e7114f0e26d1b2c4c048044db9fcc27603, 85aca407c560aba81b5ce9d3d6cf94c74077d19b, d136b29bf91dd8e3161281b87de597b7311d9462, or 9b2854f86f0b56e9027d68e7a3fc909d1a9b566f.
Until updated, block inbound SCTP traffic from untrusted networks where that will not disrupt required services.
Restart into the updated kernel and confirm the running kernel is the vendor-provided fixed build.

Usually a quick update

What is it

A flaw in the operating system’s SCTP networking code lets a malicious packet confuse how it tracks network connections. It is like a forged change request causing a receptionist to discard the wrong contact record, then continue using that discarded record; the result can be a service failure or loss of control of the system.

Who is affected

This matters to you if you run the linux kernel on servers, appliances, virtual machines, or containers that use SCTP networking. It is especially relevant for systems exposed to untrusted networks, because no attacker login or user action is required. It is a risk when SCTP traffic can reach the affected system.

How urgent is it

A remote attacker can send a specially crafted SCTP packet without a login to crash a targeted service or potentially gain control of it, so this is urgent. There is no clear dated report of active exploitation, and no public exploit code is recorded, but the attack is network-reachable in the default configuration.

What to do — in detail

Confirm exposure by identifying linux kernel hosts with SCTP enabled, SCTP listeners, or network paths that permit inbound SCTP traffic. Review firewall and load-balancer rules as well as applications that use SCTP.

Install your operating-system vendor’s kernel update that contains the applicable backport. The supplied fixes are identified by commit rather than release branches: a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293, a63afa1f9b12d5293cbe0b77fd45dc0632533a13, 2b324ba3494ae958cba16a453e3e71489b4de7fc, fedeb4468987bcaff85fe3061de5ae052d414740, 74e8f3e7114f0e26d1b2c4c048044db9fcc27603, 85aca407c560aba81b5ce9d3d6cf94c74077d19b, d136b29bf91dd8e3161281b87de597b7311d9462, and 9b2854f86f0b56e9027d68e7a3fc909d1a9b566f. Because no release-version mapping is provided, confirm the fixed package with your distribution or kernel vendor rather than comparing only upstream version labels.

A normal vendor kernel update and reboot should be the upgrade path; no application-level breaking change is identified in the findings. If patching is delayed, deny inbound SCTP at network boundaries or disable SCTP where it is not required, after validating service dependencies. No CISA KEV remediation due date applies because this CVE is not listed in KEV. Monitor for unexpected SCTP-related service crashes, kernel faults, and attempted SCTP traffic reaching systems that should not use it.

Technical context

CVSS v3.1 is 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw is a use-after-free in SCTP ASCONF DEL-IP processing: a crafted sequence can free the transport cached for an ASCONF, then reuse its dangling pointer while setting primary or active paths. The attack vector is network-based, requires neither authentication nor user interaction, and is reachable in the default configuration; additional preconditions are not known. EPSS is 1.5% (72nd percentile) with a flat trend. CISA KEV does not list this CVE, and the findings report no confirmed in-the-wild exploitation or public exploit code; research demonstrations were reported by Tencent researchers.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Affected Products

Linux

oss-projectaka the linux kernel

LinuxOn-premOS

Operating Systems / linux-distro

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-64564?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

References

https://git.kernel.org/stable/c/2b324ba3494ae958cba16a453e3e71489b4de7fc

git.kernel.org

https://git.kernel.org/stable/c/74e8f3e7114f0e26d1b2c4c048044db9fcc27603

git.kernel.org

https://git.kernel.org/stable/c/85aca407c560aba81b5ce9d3d6cf94c74077d19b

git.kernel.org

and 12 more references View all →

News mentions

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-64564 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows