A known peer can free memory the network stack still uses
Brief
Neither fix is in 7.1.8.
Notes
beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3 (Qing Ming, 2026-08-12). Clears the “new transport” pointer when a peer is removed, so a later heartbeat does not read a freed transport.
8c283e7b56adce00193837f3311b06662466fb21 (Yuxiang Yang, 2026-08-12). Clears the cached address-change chunk when a peer-restart purge frees it, so a delayed ack does not use freed memory.
Both have Fixes: and Cc: stable. Both are use-after-free. The path needs SCTP authentication. The commits do not say remote unauthenticated or local privilege escalation. Not in 7.1.8.
Commit beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3; 8c283e7b56adce00193837f3311b06662466fb21