CVE-2026-64564

sctp: don't free the ASCONF's own transport in DEL-IP processing

No known exploitation. EPSS puts it in the 71st percentile. No fix published yet.

CVSS 3.19.8Critical EPSS percentile71st1.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-08-04Updated 2026-08-19Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your linux kernel systems use SCTP or accept SCTP traffic from untrusted networks.
Ask your operating-system provider for a kernel update that includes the fix for CVE-2026-64564.
Deploy a kernel containing the applicable fix commit: a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293, a63afa1f9b12d5293cbe0b77fd45dc0632533a13, 2b324ba3494ae958cba16a453e3e71489b4de7fc, fedeb4468987bcaff85fe3061de5ae052d414740, 74e8f3e7114f0e26d1b2c4c048044db9fcc27603, 85aca407c560aba81b5ce9d3d6cf94c74077d19b, d136b29bf91dd8e3161281b87de597b7311d9462, or 9b2854f86f0b56e9027d68e7a3fc909d1a9b566f.
Until updated, block inbound SCTP traffic from untrusted networks where that will not disrupt required services.
Restart into the updated kernel and confirm the running kernel is the vendor-provided fixed build.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

In plain language

Written by AI from the record

This is a critical flaw in the linux kernel: if your systems accept SCTP network traffic, act urgently because a remote attacker can crash or potentially take control of the service.

Unauthenticated network attack against SCTP ASCONF DEL-IP processing can create a use-after-free condition, causing service disruption or potential code execution.

If you're affected

Network service outage
Possible system takeover
Business application disruption
Customer data exposure
Recovery and downtime costs

What is it

A flaw in the operating system’s SCTP networking code lets a malicious packet confuse how it tracks network connections. It is like a forged change request causing a receptionist to discard the wrong contact record, then continue using that discarded record; the result can be a service failure or loss of control of the system.

Who is affected

This matters to you if you run the linux kernel on servers, appliances, virtual machines, or containers that use SCTP networking. It is especially relevant for systems exposed to untrusted networks, because no attacker login or user action is required. It is a risk when SCTP traffic can reach the affected system.

How urgent is it

A remote attacker can send a specially crafted SCTP packet without a login to crash a targeted service or potentially gain control of it, so this is urgent. There is no clear dated report of active exploitation, and no public exploit code is recorded, but the attack is network-reachable in the default configuration.

What to do — in detail

Confirm exposure by identifying linux kernel hosts with SCTP enabled, SCTP listeners, or network paths that permit inbound SCTP traffic. Review firewall and load-balancer rules as well as applications that use SCTP.

Install your operating-system vendor’s kernel update that contains the applicable backport. The supplied fixes are identified by commit rather than release branches: a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293, a63afa1f9b12d5293cbe0b77fd45dc0632533a13, 2b324ba3494ae958cba16a453e3e71489b4de7fc, fedeb4468987bcaff85fe3061de5ae052d414740, 74e8f3e7114f0e26d1b2c4c048044db9fcc27603, 85aca407c560aba81b5ce9d3d6cf94c74077d19b, d136b29bf91dd8e3161281b87de597b7311d9462, and 9b2854f86f0b56e9027d68e7a3fc909d1a9b566f. Because no release-version mapping is provided, confirm the fixed package with your distribution or kernel vendor rather than comparing only upstream version labels.

A normal vendor kernel update and reboot should be the upgrade path; no application-level breaking change is identified in the findings. If patching is delayed, deny inbound SCTP at network boundaries or disable SCTP where it is not required, after validating service dependencies. No CISA KEV remediation due date applies because this CVE is not listed in KEV. Monitor for unexpected SCTP-related service crashes, kernel faults, and attempted SCTP traffic reaching systems that should not use it.

Technical context

CVSS v3.1 is 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw is a use-after-free in SCTP ASCONF DEL-IP processing: a crafted sequence can free the transport cached for an ASCONF, then reuse its dangling pointer while setting primary or active paths. The attack vector is network-based, requires neither authentication nor user interaction, and is reachable in the default configuration; additional preconditions are not known. EPSS is 1.5% (72nd percentile) with a flat trend. CISA KEV does not list this CVE, and the findings report no confirmed in-the-wild exploitation or public exploit code; research demonstrations were reported by Tencent researchers.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS71st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.4% chance of exploitation activity in the next 30 days, which ranks it in the 71st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 15 days, from the signal feeds we watch.

2026-08-19Record updated
2026-08-17Record updated
2026-08-09Record updated
2026-08-08OpenVAS check addedrecord updated, record updated
2026-08-07Record updatedrecord updated
2026-08-06Record updated

Affected products

Linuxoss-projectaka the linux kernel
- LinuxOSOn-premOperating Systems / linux-distro

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Sources

References in the record

And 12 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account