CVE-2026-74688: sctp: clear control chunk transport if it is being removed

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear control chunk transport if it is being removed

sctp_make_heartbeat_ack() caches the destination transport in
chunk->transport without taking a reference. When src_out_of_asoc_ok is
enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead
of being transmitted immediately.

If the peer transport is removed while the chunk is still queued,
sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing,
but only clears cached transport pointers in out_chunk_list.  The queued
control chunk therefore retains a dangling transport pointer.

Once an ASCONF_ACK clears the suppression and the queued control chunk is
transmitted, SCTP dereferences the stale transport pointer, leading to a
use-after-free.

Fix this by also clearing chunk->transport for queued control chunks in
control_chunk_list when removing the transport.

The Linux kernel CVE team has assigned CVE-2026-74688 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.1 with commit 8a07eb0a50aebc8c95478d49c28c7f8419a26cef and fixed in 5.10.265 with commit dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886
	Issue introduced in 3.1 with commit 8a07eb0a50aebc8c95478d49c28c7f8419a26cef and fixed in 5.15.216 with commit fad4766a74220fe579c6fcaa10ba01c23529814f
	Issue introduced in 3.1 with commit 8a07eb0a50aebc8c95478d49c28c7f8419a26cef and fixed in 6.1.183 with commit 936658ec41c28c397ef390140e02d4c91ade92f0
	Issue introduced in 3.1 with commit 8a07eb0a50aebc8c95478d49c28c7f8419a26cef and fixed in 6.6.152 with commit 8de65194a04d2552cd39b6c67d942d490f22d174
	Issue introduced in 3.1 with commit 8a07eb0a50aebc8c95478d49c28c7f8419a26cef and fixed in 6.12.104 with commit 6160e756db81d6cb63e3e2952efcf6c5134be385
	Issue introduced in 3.1 with commit 8a07eb0a50aebc8c95478d49c28c7f8419a26cef and fixed in 6.18.45 with commit 18d704bdd809377dfd81a3c2f42426763b5da227
	Issue introduced in 3.1 with commit 8a07eb0a50aebc8c95478d49c28c7f8419a26cef and fixed in 7.1.9 with commit 4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7
	Issue introduced in 3.1 with commit 8a07eb0a50aebc8c95478d49c28c7f8419a26cef and fixed in 7.2 with commit c9158ceaf27780ef64534ad72f44ffde3f8ccc49

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74688
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sctp/associola.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886
	https://git.kernel.org/stable/c/fad4766a74220fe579c6fcaa10ba01c23529814f
	https://git.kernel.org/stable/c/936658ec41c28c397ef390140e02d4c91ade92f0
	https://git.kernel.org/stable/c/8de65194a04d2552cd39b6c67d942d490f22d174
	https://git.kernel.org/stable/c/6160e756db81d6cb63e3e2952efcf6c5134be385
	https://git.kernel.org/stable/c/18d704bdd809377dfd81a3c2f42426763b5da227
	https://git.kernel.org/stable/c/4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7
	https://git.kernel.org/stable/c/c9158ceaf27780ef64534ad72f44ffde3f8ccc49