CVE-2026-64564

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

Why is this CVE critical priority?

See ubuntu cvss score

Learn more about Ubuntu priority

Mitigation

If the sctp module is not needed, disable it completely and across reboots by running: $ echo "install sctp /bin/false" | \ sudo tee /etc/modprobe.d/disable-sctp.conf $ sudo update-initramfs -u And unload the module if already loaded and not in use: $ sudo rmmod sctp

Status

Show unmaintained releases

Package	Ubuntu Release	Status

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details

Severity score breakdown

CVSS version:

Base score 9.3 · Critical

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	Low
Attack requirements	None
Privileges required	None
User interaction	None
Vulnerable system - Confidentiality impact	High
Vulnerable system - Integrity impact	High
Vulnerable system - Availability impact	High
Subsequent system - Confidentiality impact	None
Subsequent system - Integrity impact	None
Subsequent system - Availability impact	None

Scores

Parameter	Value
Base score	9.3 · Critical
Base + Threat score	-
Base + Environmental score	-
Base + Threat + Environmental score	-

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Base score 9.8 · Critical

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High

Scores

Parameter	Value
Base score	9.8 · Critical
Exploitability score	-
Impact score	-

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

USN-8781-1
Linux kernel (NVIDIA Tegra) vulnerabilities
18 September 2026

USN-8876-1
Linux kernel (Azure CVM) vulnerabilities
6 October 2026

USN-8878-1
Linux kernel (GCP) vulnerabilities
6 October 2026

USN-8879-1
Linux kernel (Oracle) vulnerabilities
6 October 2026

USN-8877-1
Linux kernel (GCP) vulnerabilities
6 October 2026

USN-8875-1
Linux kernel vulnerabilities
6 October 2026

USN-8888-1
Linux kernel (Azure) vulnerabilities
6 October 2026

USN-8889-1
Linux kernel (OEM) vulnerabilities
6 October 2026

USN-8887-1
Linux kernel vulnerabilities
6 October 2026

USN-8887-2
Linux kernel (AWS) vulnerabilities
8 October 2026

USN-8888-2
Linux kernel (Azure) vulnerabilities
8 October 2026

USN-8875-2
Linux kernel (NVIDIA) vulnerabilities
9 October 2026

USN-8887-3
Linux kernel vulnerabilities
9 October 2026