CVE-2026-74688

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear control chunk transport if it is being removed

sctpmakeheartbeat_ack() caches the destination transport in

chunk->transport without taking a reference. When srcoutofasocok is

enabled, the HEARTBEAT ACK may remain queued on controlchunklist instead

of being transmitted immediately.

If the peer transport is removed while the chunk is still queued,

sctpassocrm_peer() drops the transport and schedules it for RCU freeing,

but only clears cached transport pointers in outchunklist.  The queued

control chunk therefore retains a dangling transport pointer.

Once an ASCONF_ACK clears the suppression and the queued control chunk is

transmitted, SCTP dereferences the stale transport pointer, leading to a

use-after-free.

Fix this by also clearing chunk->transport for queued control chunks in

controlchunklist when removing the transport.