CVE-2026-64564: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64564 is a use-after-free vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically in ASCONF (Address Configuration Change) chunk processing. The flaw allows an unauthenticated network attacker to send a specially crafted SCTP ASCONF chunk that frees a transport endpoint and subsequently dereferences the dangling pointer, leading to kernel crash or association corruption. The vulnerability was published on August 4, 2026, and affects Linux kernel versions from 2.6.25 up to (but not including) the patched stable releases (GitHub Advisory). Fixed versions include 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. The CVSS severity is estimated as Medium (GitHub Advisory).

The root cause is a use-after-free (CWE-416) in sctp_process_asconf(), which caches the transport associated with an ASCONF chunk in asconf->transport. When an ASCONF chunk contains an Address Parameter L (different from the packet source), followed by [DEL-IP L] and then [DEL-IP 0.0.0.0], the first DEL-IP passes the source-address guard (ADDIP D8 / SCTP_ERROR_DEL_SRC_IP) and calls sctp_assoc_rm_peer() on the cached transport, freeing it via RCU-deferred reclamation. The subsequent wildcard DEL-IP then reuses the now-dangling asconf->transport pointer in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(), dereferencing freed memory and corrupting asoc->peer.primary_path and active_path, ultimately leaving the association with transport_count of 0 and dangling pointers. The fix rejects any DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to crash the Linux kernel (denial of service) or render an SCTP association permanently unusable by corrupting its transport management structures, preventing any further data transmission or reception. The corruption of primary_path and active_path with freed memory pointers can cause unpredictable kernel behavior, including potential memory corruption beyond the immediate association. Systems relying on SCTP for critical communications (e.g., telecommunications infrastructure, certain VoIP and signaling systems) are at elevated risk of service disruption (GitHub Advisory).

1. Reconnaissance: Identify target systems with SCTP enabled and reachable over the network (e.g., using port scanners with SCTP support such as nmap -sY targeting SCTP ports like 36412 for S1AP or other SCTP-based services).
2. Establish SCTP association: Initiate a valid SCTP association with the target to reach the ASCONF processing code path.
3. Craft malicious ASCONF chunk: Construct a single ASCONF chunk containing, in order: an Address Parameter L (an IP address different from the packet's source address), a DEL-IP L parameter, and a wildcard DEL-IP 0.0.0.0 parameter.
4. Send crafted chunk: Transmit the malicious ASCONF chunk to the target. The DEL-IP L passes the source-address guard and triggers sctp_assoc_rm_peer() on the cached transport, freeing it.
5. Trigger use-after-free: The subsequent DEL-IP 0.0.0.0 reuses the dangling asconf->transport pointer in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(), corrupting the association's transport list and primary path pointers.
6. Achieve denial of service: The kernel crashes or the SCTP association becomes permanently unusable with transport_count of 0 and dangling primary_path/active_path pointers (GitHub Advisory).

• Network: Unexpected or malformed SCTP ASCONF chunks containing multiple DEL-IP parameters (especially a non-source address DEL-IP followed by a wildcard 0.0.0.0 DEL-IP) from external or untrusted sources.
• Logs: Kernel panic or oops messages referencing sctp_process_asconf, sctp_assoc_rm_peer, sctp_assoc_set_primary, or sctp_assoc_del_nonprimary_peers in /var/log/kern.log or dmesg output.
• Logs: RCU stall warnings or use-after-free reports (e.g., KASAN/KFENCE output) involving SCTP transport structures.
• Process/System: Sudden kernel crashes (system reboots, kernel panics) on systems running SCTP services; SCTP associations dropping unexpectedly with transport_count reaching 0.

Apply the patched Linux kernel versions: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 (or later). The specific upstream fix commits are available at the kernel stable repository (e.g., fedeb4468987, 74e8f3e7114f, 85aca407c560, d136b29bf91d, 9b2854f86f0b) (GitHub Advisory). As a workaround where SCTP is not required, disable the SCTP kernel module (modprobe -r sctp or blacklist it in /etc/modprobe.d/) to eliminate the attack surface. If SCTP is required, implement network-level filtering (firewall rules) to restrict SCTP traffic to trusted sources only.