CVE-2026-64564

A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF (Add IP Address Configuration) chunks, including DEL-IP (Delete IP Address) parameters, to trigger a use-after-free condition. This memory corruption could lead to a system crash, resulting in a denial of service, and potentially allow for arbitrary code execution.

This vulnerability is rated as an Important impact on Red Hat Enterprise Linux because memory corruption within kernel space can lead to a system-wide denial of service or facilitate privilege escalation. However, the SCTP kernel module is not loaded by default on standard Red Hat installations unless explicitly configured or required by running applications. Consequently, exposure is limited to environments where SCTP services are actively utilized or where local unprivileged users can trigger module loading.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the sctp kernel module from loading. Create a file named /etc/modprobe.d/disable-sctp.conf with the following content:

install sctp /bin/true
blacklist sctp

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix.