Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-74587

sctp: fix use-after-free of cached ASCONF chunk

CVSS 9.8 CriticalCriticalEPSS 0.0050 · 43rd percentile

Critical, because:

  • CVSS score 9.8: 9.0 or more.

How we decide what’s critical

Published by the CVE Program (CNA: Linux) at 22 Aug 2026, 15:31 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected a000c01e60e40e15304ffe48fff051d17a7bea91 to before 10459b03e2d9ee12435e96f587de4d4cacdbf435 git
  • affected a000c01e60e40e15304ffe48fff051d17a7bea91 to before e1bb114e09372fd6e03387ced9ef566da336ed6c git
  • affected a000c01e60e40e15304ffe48fff051d17a7bea91 to before 179676f0166230c80053a392303485b37c93dd33 git
  • affected a000c01e60e40e15304ffe48fff051d17a7bea91 to before dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d git
  • affected a000c01e60e40e15304ffe48fff051d17a7bea91 to before 618b5c6d049896fcfabb91afc072954c92cb2693 git
  • affected a000c01e60e40e15304ffe48fff051d17a7bea91 to before 07daf4f9750104960a1d60831b2353c0d41f35fb git
  • affected a000c01e60e40e15304ffe48fff051d17a7bea91 to before d949992bc3f00027a2c755e860a11950c75f6073 git
  • affected a000c01e60e40e15304ffe48fff051d17a7bea91 to before 8c283e7b56adce00193837f3311b06662466fb21 git
Other versions: unaffected
Linux Linux
  • affected 3.0
  • unaffected before 3.0 semver
  • unaffected 5.10.265 to 5.10.*, inclusive semver
  • unaffected 5.15.216 to 5.15.*, inclusive semver
  • unaffected 6.1.183 to 6.1.*, inclusive semver
  • unaffected 6.6.152 to 6.6.*, inclusive semver
  • unaffected 6.12.104 to 6.12.*, inclusive semver
  • unaffected 6.18.45 to 6.18.*, inclusive semver
  • unaffected 7.1.9 to 7.1.*, inclusive semver
  • unaffected 7.2 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-74587
CNA
Linux
Tags
Published
22 Aug 2026
Updated
16 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
9.8 Critical 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CNA (Linux)
  • CISA KEV Not listed.
  • EPSS 0.0050, the 43rd percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 22 Aug 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.