CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix use-after-free of cached ASCONF chunk

addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal
ASCONF-ACK completion path releases the chunk and clears the pointer.

However, sctp_asconf_queue_teardown() releases the cached chunk without
clearing addip_last_asconf. During peer restart handling,
sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes
sctp_asconf_queue_teardown() while the association remains alive and leaves
the pointer dangling.

A delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),
which accesses the stale chunk and passes it to sctp_process_asconf_ack(),
causing a use-after-free and a second release.

Clearing the pointer exposes a race with T4 expiry. Peer restart handling
queues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses
timer_delete(), which does not wait for a callback already running on
another CPU. Such a callback can reach sctp_sf_t4_timer_expire() after
the purge and dereference NULL.

Clear addip_last_asconf after releasing the cached chunk, and make
sctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding
ASCONF remains.

The Linux kernel CVE team has assigned CVE-2026-74587 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.0 with commit a000c01e60e40e15304ffe48fff051d17a7bea91 and fixed in 5.10.265 with commit 10459b03e2d9ee12435e96f587de4d4cacdbf435
	Issue introduced in 3.0 with commit a000c01e60e40e15304ffe48fff051d17a7bea91 and fixed in 5.15.216 with commit e1bb114e09372fd6e03387ced9ef566da336ed6c
	Issue introduced in 3.0 with commit a000c01e60e40e15304ffe48fff051d17a7bea91 and fixed in 6.1.183 with commit 179676f0166230c80053a392303485b37c93dd33
	Issue introduced in 3.0 with commit a000c01e60e40e15304ffe48fff051d17a7bea91 and fixed in 6.6.152 with commit dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d
	Issue introduced in 3.0 with commit a000c01e60e40e15304ffe48fff051d17a7bea91 and fixed in 6.12.104 with commit 618b5c6d049896fcfabb91afc072954c92cb2693
	Issue introduced in 3.0 with commit a000c01e60e40e15304ffe48fff051d17a7bea91 and fixed in 6.18.45 with commit 07daf4f9750104960a1d60831b2353c0d41f35fb
	Issue introduced in 3.0 with commit a000c01e60e40e15304ffe48fff051d17a7bea91 and fixed in 7.1.9 with commit d949992bc3f00027a2c755e860a11950c75f6073
	Issue introduced in 3.0 with commit a000c01e60e40e15304ffe48fff051d17a7bea91 and fixed in 7.2 with commit 8c283e7b56adce00193837f3311b06662466fb21

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74587
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sctp/associola.c
	net/sctp/sm_statefuns.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/10459b03e2d9ee12435e96f587de4d4cacdbf435
	https://git.kernel.org/stable/c/e1bb114e09372fd6e03387ced9ef566da336ed6c
	https://git.kernel.org/stable/c/179676f0166230c80053a392303485b37c93dd33
	https://git.kernel.org/stable/c/dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d
	https://git.kernel.org/stable/c/618b5c6d049896fcfabb91afc072954c92cb2693
	https://git.kernel.org/stable/c/07daf4f9750104960a1d60831b2353c0d41f35fb
	https://git.kernel.org/stable/c/d949992bc3f00027a2c755e860a11950c75f6073
	https://git.kernel.org/stable/c/8c283e7b56adce00193837f3311b06662466fb21