CVE-2026-74588

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. This use-after-free vulnerability occurs when the system improperly handles chunk transport pointers during the retransmission process. A remote attacker can exploit this by sending specially crafted Selective Acknowledgment (SACK) packets, which can lead to a dangling pointer dereference. The most significant consequence is a system crash, resulting in a denial of service (DoS). In some scenarios, this could potentially lead to arbitrary code execution.

This vulnerability is rated as Important because an established SCTP peer can remotely trigger a use-after-free condition in kernel memory, potentially leading to a kernel crash or code execution. In standard Red Hat Enterprise Linux deployments, the sctp kernel module is not loaded by default unless an application explicitly creates SCTP sockets. Therefore, only systems running specialized network services that accept SCTP connections are exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent exploitation of this kernel vulnerability, the sctp module can be blacklisted. Create a file named /etc/modprobe.d/disable-sctp.conf with the content install sctp /bin/true and blacklist sctp. Regenerate the initramfs using dracut -f -v (or mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r) for older systems) and reboot the system. This action will disable SCTP functionality; verify no critical services depend on it before implementation. A system reboot is required for the changes to take effect.