{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-74688 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-74688 is a critical use after free vulnerability in Linux, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-74688 and fix it if it is affected.\n\nWhat it is: CVE-2026-74688 is a critical use after free vulnerability in Linux, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-74688 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-74688/ (Markdown: https://insights.sbomify.com/CVE-2026-74688/index.md)","id":"CVE-2026-74688","markdown":"https://insights.sbomify.com/CVE-2026-74688/index.md","name":"CVE-2026-74688","record":{"aliases":["AZL-97196","BELL-CVE-2026-74688","DEBIAN-CVE-2026-74688","GHSA-3vfv-7x6v-8jg6","UBUNTU-CVE-2026-74688"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":true,"product_category":"Linux kernel","requires_auth":"none","summary":"A use-after-free in the Linux kernel SCTP implementation allows attackers to execute arbitrary code or escalate privileges when specific transport removal conditions occur.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear control chunk transport if it is being removed\n\nsctp_make_heartbeat_ack() caches the destination transport in\nchunk-\u003etransport without taking a reference. When src_out_of_asoc_ok is\nenabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead\nof being transmitted immediately.\n\nIf the peer transport is removed while the chunk is still queued,\nsctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing,\nbut only clears cached transport pointers in out_chunk_list.  The queued\ncontrol chunk therefore retains a dangling transport pointer.\n\nOnce an ASCONF_ACK clears the suppression and the queued control chunk is\ntransmitted, SCTP dereferences the stale transport pointer, leading to a\nuse-after-free.\n\nFix this by also clearing chunk-\u003etransport for queued control chunks in\ncontrol_chunk_list when removing the transport.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"sctp: clear control chunk transport if it is being removed","id":"CVE-2026-74688","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"net/atm: fix slab-out-of-bounds read in vcc_setsockopt()","id":"CVE-2026-74689"},"packages":[],"prev":{"headline":"watchdog: at91sam9_wdt: prevent timer rearm during teardown","id":"CVE-2026-74687"},"products":["Linux"],"published":"2026-08-22","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel SCTP implementation allows attackers to execute arbitrary code or escalate privileges when specific transport removal conditions occur.","url":"https://insights.sbomify.com/CVE-2026-74688/"}