CVE-2026-64564

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: don't free the ASCONF's own transport in DEL-IP processing

sctp_process_asconf() caches the transport the ASCONF chunk is processed

against in asconf->transport (== chunk->transport, set once in sctp_rcv()).

For an ASCONF located through its Address Parameter by

__sctp_rcv_asconf_lookup(), that cached transport corresponds to the

Address Parameter, which need not be the packet's source address.

sctp_process_asconf_param() rejects a DEL-IP for the packet source address

(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.

A single ASCONF can therefore carry, in order:

[Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]

where L differs from the source. The DEL-IP for L passes the D8 check and

calls sctp_assoc_rm_peer() on the transport that asconf->transport still

points at, freeing it (RCU-deferred). The following wildcard DEL-IP then

reuses the now-dangling asconf->transport in sctp_as

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References