🟠 High | Source: Microsoft Security Response Center
CVE-2026-64564 is a kernel-level vulnerability in the SCTP (Stream Control Transmission Protocol) networking stack, specifically in how it handles transport object memory during DEL-IP address processing in ASCONF operations. Improper freeing of a transport pointer can lead to a use-after-free condition, which may be exploitable to cause a denial of service or potentially execute arbitrary code. This affects Linux kernel components surfaced through Azure’s underlying infrastructure.
Security Architect’s Take: Review whether your Azure workloads rely on SCTP-enabled networking or custom kernel configurations, and ensure host and node OS patches are applied promptly once Microsoft releases them. For AKS or IaaS workloads with custom Linux images, prioritise kernel patching cycles and consider network-level controls to restrict SCTP traffic where it is not required.
Original advisory: CVE-2026-64564 sctp: don’t free the ASCONF’s own transport in DEL-IP processing