diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 3c2a281347e1c14d30050cc770f811eb882bc2c7..1bb3c5c35d2ab5fc78f252d2edc9e1f2c70b6dab 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -1179,8 +1179,10 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
 		tchunk = list_entry(lchunk, struct sctp_chunk,
 				    transmitted_list);
 		tsn = ntohl(tchunk->subh.data_hdr->tsn);
-		if (TSN_lte(tsn, ctsn))
+		if (TSN_lte(tsn, ctsn)) {
+			list_del_init(&tchunk->transmitted_list);
 			sctp_chunk_free(tchunk);
+		}
 	}
 
 	/* ii) Set rwnd equal to the newly received a_rwnd minus the
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 80b3c4f09e6c18cd55149359cdb5e0b83e3628e1..e45be4e3f80d733c8f3eb27773651ad1a4d44add 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3224,6 +3224,7 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
 	}
 
 	/* Free the cached last sent asconf chunk. */
+	list_del_init(&asconf->transmitted_list);
 	sctp_chunk_free(asconf);
 	asoc->addip_last_asconf = NULL;