{"id":"CVE-2026-74588","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: keep chunk->transport in step with the list it is queued on\n\n__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's\ntransmitted list without upd…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: keep chunk->transport in step with the list it is queued on\n\n__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's\ntransmitted list without upd…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-825"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9"],"patched":["10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_nfv_v_8","enterprise_linux_real_time_v_10","enterprise_linux_rt_v_8"],"published":"2026-08-22","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:42.177","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74588","references":[{"url":"https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74588.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-74588"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521384"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74588"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74588"},{"url":"https://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74588-29ed@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:85321"},{"url":"https://access.redhat.com/errata/RHSA-2026:85773"},{"url":"https://access.redhat.com/errata/RHSA-2026:85774"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.005,"epssPercentile":0.42613,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T19:01:29.030905Z"},"scores":{"nvd":9.8,"vendor":8.8,"cna":9.8},"ingestedAt":"2026-08-23T06:43:33.635Z","slug":"CVE-2026-74588","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: keep chunk->transport in step with the list it is queued on\n\n__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's\ntransmitted list without updating chunk->transport:\n\n\tif (chunk->tsn_gap_acked) {\n\t\tlist_move_tail(&chunk->transmitted_list,\n\t\t\t       &transport->transmitted);\n\t\tcontinue;\n\t}\n\nThe chunk then sits on a live transport's list while chunk->transport still\nnames a different one.  If that transport is removed - sctp_assoc_rm_peer()\nfrom an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk\nis left with a dangling pointer.  sctp_assoc_rm_peer() scrubs\npeer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on\nneither.\n\nThe pointer is not followed while tsn_gap_acked is set.  A SACK that\nreneges on the TSN clears the flag, and the next SACK reaches\n\n\ttchunk->transport->flight_size -= sctp_data_size(tchunk);\n\ninside the freed transport.  KASAN reports a slab-use-after-free read in\nsctp_check_transmitted(), freed from sctp_assoc_rm_peer().  Both the\nremoval and the SACKs come from the association peer.\n\nSet chunk->transport at the move.  The ordinary resend path needs nothing:\nit reaches its list_move_tail() only after sctp_packet_append_chunk()\nreturned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the\nchunk by then.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74588.json)\n- **RHSA-2026:85321** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85321)\n- **RHSA-2026:85773** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85773)\n- **RHSA-2026:85774** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85774)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":220148,"id":"CVE-2026-74588","ts":1791984787687,"field":"cvss","old":"8.8","new":"9.8"},{"seq":220147,"id":"CVE-2026-74588","ts":1791984787687,"field":"severity","old":"high","new":"critical"},{"seq":212559,"id":"CVE-2026-74588","ts":1790668212978,"field":"cvss","old":null,"new":"8.8"},{"seq":212558,"id":"CVE-2026-74588","ts":1790668212978,"field":"severity","old":"none","new":"high"}]}