{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-64564 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-64564 is a critical use after free vulnerability in Linux, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64564 and fix it if it is affected.\n\nWhat it is: CVE-2026-64564 is a critical use after free vulnerability in Linux, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64564 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64564/ (Markdown: https://insights.sbomify.com/CVE-2026-64564/index.md)","id":"CVE-2026-64564","markdown":"https://insights.sbomify.com/CVE-2026-64564/index.md","name":"CVE-2026-64564","record":{"aliases":["AZL-94395","BELL-CVE-2026-64564","CLSA-2026-1787587623","DEBIAN-CVE-2026-64564","GHSA-xw85-w2q2-369x","UBUNTU-CVE-2026-64564"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel SCTP","requires_auth":"none","summary":"A use-after-free vulnerability in the Linux kernel SCTP implementation allows attackers to cause denial of service or potentially execute code via crafted ASCONF chunks.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: don't free the ASCONF's own transport in DEL-IP processing\n\nsctp_process_asconf() caches the transport the ASCONF chunk is processed\nagainst in asconf-\u003etransport (== chunk-\u003etransport, set once in sctp_rcv()).\nFor an ASCONF located through its Address Parameter by\n__sctp_rcv_asconf_lookup(), that cached transport corresponds to the\nAddress Parameter, which need not be the packet's source address.\n\nsctp_process_asconf_param() rejects a DEL-IP for the packet source address\n(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf-\u003etransport.\nA single ASCONF can therefore carry, in order:\n\n    [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]\n\nwhere L differs from the source. The DEL-IP for L passes the D8 check and\ncalls sctp_assoc_rm_peer() on the transport that asconf-\u003etransport still\npoints at, freeing it (RCU-deferred). The following wildcard DEL-IP then\nreuses the now-dangling asconf-\u003etransport in sctp_assoc_set_primary() and\nsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed\ntransport (-\u003eipaddr, -\u003estate) and plants the dangling pointer into\nasoc-\u003epeer.primary_path / active_path, and del_nonprimary_peers(), keeping\nonly the pointer that is no longer on the list, removes every real\ntransport, leaving the association with a transport_count of 0 and\nprimary_path/active_path pointing at freed memory.\n\nReject a DEL-IP that targets the transport the ASCONF is being processed\nagainst, mirroring the existing source-address guard, so the wildcard\nbranch can never reuse a freed transport.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-08-07","github_poc":5,"max_poc_stars":7,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-08-07T09:19:32Z","kind":"github_poc","ref":"https://github.com/ethanolgolf/CVE-2026-64564","stars":7,"title":"LPE on Deb"},{"date":"2026-08-07T12:47:28Z","kind":"github_poc","ref":"https://github.com/HackSpeak/CVE-2026-64564","stars":7,"title":"SCTPhantom (CVE-2026-64564) SCTP ASCONF DEL-IP UAF LPE PoC (Debian 13 6.12.95) — community PoC mirror, MIT; for authorized security testing"},{"date":"2026-08-19T11:55:04Z","kind":"github_poc","ref":"https://github.com/0xdeadroot/SCTPhantom-CVE-2026-64564","stars":2,"title":null},{"date":"2026-08-10T05:16:43Z","kind":"github_poc","ref":"https://github.com/suominen/sctphantom","stars":1,"title":"Tracking SCTPhantom (CVE-2026-64564), the Linux kernel SCTP ASCONF transport use-after-free"},{"date":"2026-08-11T17:01:12Z","kind":"github_poc","ref":"https://github.com/yandex-cloud-examples/yc-mk8s-sctphantom-mitigation","stars":0,"title":"DaemonSet для митигации уязвимости CVE-2026-64564 (SCTPhantom)"}],"tier":"poc_unverified"},"has_fix":true,"headline":"sctp: don't free the ASCONF's own transport in DEL-IP processing","id":"CVE-2026-64564","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":9,"next":{"headline":"Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()","id":"CVE-2026-64565"},"packages":[],"prev":{"headline":"rhashtable: clear stale iter-\u003ep on table restart","id":"CVE-2026-64563"},"products":["Linux"],"published":"2026-08-04","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel SCTP implementation allows attackers to cause denial of service or potentially execute code via crafted ASCONF chunks.","url":"https://insights.sbomify.com/CVE-2026-64564/"}