CVE-2026-74688

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. This vulnerability arises when the sctp_make_heartbeat_ack() function caches a destination transport without taking a proper reference. If the associated peer transport is removed while a HEARTBEAT ACK chunk remains queued, a dangling pointer is created. A remote attacker could exploit this use-after-free condition by triggering the transmission of the queued control chunk, potentially leading to a denial of service or arbitrary code execution.

Red Hat rates this vulnerability as Moderate severity because exploitation requires precise timing conditions and specific association state changes during transport removal, introducing significant complexity for reliable abuse. On typical Red Hat Enterprise Linux deployments, the SCTP protocol module is not loaded by default unless an application explicitly requests it. Consequently, systems running standard network configurations without SCTP services are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.