Re: [PATCH net v3] sctp: fix use-after-free of cached ASCONF chunk

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Sun,  9 Aug 2026 12:38:06 +0800 you wrote:
> addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal
> ASCONF-ACK completion path releases the chunk and clears the pointer.
> 
> However, sctp_asconf_queue_teardown() releases the cached chunk without
> clearing addip_last_asconf. During peer restart handling,
> sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes
> sctp_asconf_queue_teardown() while the association remains alive and leaves
> the pointer dangling.
> 
> [...]

Here is the summary with links:
  - [net,v3] sctp: fix use-after-free of cached ASCONF chunk
    https://git.kernel.org/netdev/net/c/8c283e7b56ad

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html