Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64564— sctp: don't free the ASCONF's own transport in DEL-IP processing

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于SCTP协议在处理DEL-IP时未保护ASCONF的transport指针，导致释放后重用，可能造成系统崩溃或内存破坏。

CVSS 9.8 · Critical EPSS 1.41% · P72

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 42e30bf3463cd37d73839376662cb79b4d5c416c< a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293 affected
42e30bf3463cd37d73839376662cb79b4d5c416c< a63afa1f9b12d5293cbe0b77fd45dc0632533a13 affected
42e30bf3463cd37d73839376662cb79b4d5c416c< 2b324ba3494ae958cba16a453e3e71489b4de7fc affected
42e30bf3463cd37d73839376662cb79b4d5c416c< fedeb4468987bcaff85fe3061de5ae052d414740 affected
42e30bf3463cd37d73839376662cb79b4d5c416c< 74e8f3e7114f0e26d1b2c4c048044db9fcc27603 affected
42e30bf3463cd37d73839376662cb79b4d5c416c< 85aca407c560aba81b5ce9d3d6cf94c74077d19b affected
42e30bf3463cd37d73839376662cb79b4d5c416c< d136b29bf91dd8e3161281b87de597b7311d9462 affected
42e30bf3463cd37d73839376662cb79b4d5c416c< 9b2854f86f0b56e9027d68e7a3fc909d1a9b566f affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64564

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
sctp: don't free the ASCONF's own transport in DEL-IP processing
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于SCTP协议在处理DEL-IP时未保护ASCONF的transport指针，导致释放后重用，可能造成系统崩溃或内存破坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 42e30bf3463cd37d73839376662cb79b4d5c416c ~ a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293 -
Linux Linux 2.6.25 -

II. Public POCs for CVE-2026-64564

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64564

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64564 (5)

Security Blog Posts for CVE-2026-64564 (1)

Same Patch Batch · Linux · 2026-08-04 · 5 CVEs total

CVE-2026-64562 8.8 HIGH KVM: nVMX: Hide shadow VMCS right after VMCLEAR
CVE-2026-64561 8.8 HIGH KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
CVE-2026-64563 7.8 HIGH rhashtable: clear stale iter->p on table restart
CVE-2026-64565 Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64564

No comments yet

Leave a comment