# CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing

> A use-after-free vulnerability in the Linux kernel SCTP implementation allows attackers to cause denial of service or potentially execute code via crafted ASCONF chunks.

- **Severity:** Critical 9.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 4 Aug 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-94395, BELL-CVE-2026-64564, CLSA-2026-1787587623, DEBIAN-CVE-2026-64564, GHSA-xw85-w2q2-369x, UBUNTU-CVE-2026-64564

## What is CVE-2026-64564?

CVE-2026-64564 is a critical use after free vulnerability in Linux, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

sctp: don't free the ASCONF's own transport in DEL-IP processing

sctp_process_asconf() caches the transport the ASCONF chunk is processed
against in asconf->transport (== chunk->transport, set once in sctp_rcv()).
For an ASCONF located through its Address Parameter by
__sctp_rcv_asconf_lookup(), that cached transport corresponds to the
Address Parameter, which need not be the packet's source address.

sctp_process_asconf_param() rejects a DEL-IP for the packet source address
(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.
A single ASCONF can therefore carry, in order:

    [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]

where L differs from the source. The DEL-IP for L passes the D8 check and
calls sctp_assoc_rm_peer() on the transport that asconf->transport still
points at, freeing it (RCU-deferred). The following wildcard DEL-IP then
reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and
sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed
transport (->ipaddr, ->state) and plants the dangling pointer into
asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping
only the pointer that is no longer on the list, removes every real
transport, leaving the association with a transport_count of 0 and
primary_path/active_path pointing at freed memory.

Reject a DEL-IP that targets the transport the ASCONF is being processed
against, mirroring the existing source-address guard, so the wildcard
branch can never reuse a freed transport.

Weakness: CWE-416 (Use After Free)

## Which versions are affected by CVE-2026-64564?


## How do I fix CVE-2026-64564?

Apply the vendor's patch.

## Is CVE-2026-64564 being exploited?

There is no known exploitation of CVE-2026-64564 in the wild and no public exploit code.

Public exploit code:

- LPE on Deb (github_poc): https://github.com/ethanolgolf/CVE-2026-64564
- SCTPhantom (CVE-2026-64564) SCTP ASCONF DEL-IP UAF LPE PoC (Debian 13 6.12.95) — community PoC mirror, MIT; for authorized security testing (github_poc): https://github.com/HackSpeak/CVE-2026-64564
- https://github.com/0xdeadroot/SCTPhantom-CVE-2026-64564 (github_poc): https://github.com/0xdeadroot/SCTPhantom-CVE-2026-64564
- Tracking SCTPhantom (CVE-2026-64564), the Linux kernel SCTP ASCONF transport use-after-free (github_poc): https://github.com/suominen/sctphantom
- DaemonSet для митигации уязвимости CVE-2026-64564 (SCTPhantom) (github_poc): https://github.com/yandex-cloud-examples/yc-mk8s-sctphantom-mitigation

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-64564 and fix it if it is affected.

What it is: CVE-2026-64564 is a critical use after free vulnerability in Linux, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-64564 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-64564/ (Markdown: https://insights.sbomify.com/CVE-2026-64564/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-64564
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64564
- OSV: https://osv.dev/vulnerability/CVE-2026-64564

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-64564/
Summaries are generated and may contain mistakes; the official description above is the record.