CVE-2026-52924 Overview
CVE-2026-52924 is a use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in the handling of stale COOKIE-ECHO chunks during association setup. When an SCTP association rolls back from COOKIE_ECHOED to COOKIE_WAIT after receiving a Stale Cookie ERROR, sctp_stream_update() replaces the outbound stream table but fails to invalidate the cached stream->out_curr pointer. Subsequent scheduler dequeue paths dereference the freed sctp_stream_out entry, producing a KASAN slab-use-after-free condition reachable from network input processing.
Critical Impact
Local or remote SCTP peers can trigger kernel use-after-free conditions, potentially leading to kernel memory corruption, denial of service, or privilege escalation on systems that process SCTP traffic.
Affected Products
- Linux kernel (mainline branch prior to commit 1d4652f6)
- Linux kernel stable branches receiving SCTP backports referenced in the published fix commits
- Distributions shipping unpatched SCTP-enabled kernels
Discovery Timeline
- 2026-06-24 - CVE-2026-52924 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52924
Vulnerability Analysis
The vulnerability affects the SCTP subsystem in net/sctp/. SCTP uses a four-way handshake involving INIT, INIT-ACK, COOKIE-ECHO, and COOKIE-ACK chunks. During reconfiguration or setup, sctp_stream_update() rebuilds the outbound stream table when an association transitions into COOKIE_WAIT. The function assumes that no user data has been queued at that point.
This assumption breaks inside sctp_sf_do_5_2_6_stale(), which handles Stale Cookie ERROR responses. By the time a stale cookie is processed, user data may already have been queued and even bundled with the original COOKIE-ECHO chunk. The rollback frees the old stream table while leaving stream->out_curr pointing at a released sctp_stream_out entry.
When scheduler dequeue paths such as sctp_sched_fcfs_dequeue, round-robin, or priority schedulers later access stream->out_curr->ext, they read freed slab memory. KASAN reports confirm the read occurs during sctp_outq_flush reached through sctp_do_sm and sctp_rcv.
Root Cause
The root cause is incomplete state invalidation during association rollback. sctp_stream_update() releases the previous stream array via sctp_stream_free() but does not clear cached scheduler pointers, nor does it purge queued transmit and retransmit data that still references the freed stream entries.
Attack Vector
An attacker capable of sending crafted SCTP control chunks to a target endpoint can drive an association into the stale-cookie rollback path. After the peer transmits data bundled with COOKIE-ECHO, the attacker responds with a Stale Cookie ERROR. The subsequent dequeue operation dereferences freed memory, enabling a use-after-free primitive in kernel context. The vulnerability requires the target system to have SCTP enabled and reachable by the attacker.
No public proof-of-concept exploit was referenced in the advisory. The reproduction described in the upstream commit message used a local reproducer named mini_poc running under KASAN instrumentation.
Detection Methods for CVE-2026-52924
Indicators of Compromise
- KASAN reports referencing slab-use-after-free in sctp_sched_fcfs_dequeue or other SCTP scheduler functions
- Kernel oops or panic traces containing sctp_outq_flush, sctp_do_sm, sctp_assoc_bh_rcv, or sctp_inq_push
- Unexpected SCTP association resets correlated with received ERROR chunks carrying Stale Cookie cause codes
Detection Strategies
- Enable CONFIG_KASAN on test kernels to surface the use-after-free during fuzzing or staging traffic replay
- Monitor /proc/net/sctp/snmp for elevated SctpAborteds and SctpT1CookieDrops counters that may indicate stale-cookie exploitation attempts
- Inspect network telemetry for SCTP ERROR chunks with cause code 0x0003 (Stale Cookie Error) directed at production endpoints
Monitoring Recommendations
- Collect kernel ring buffer output and forward dmesg entries containing KASAN, BUG:, or sctp_ symbols to a central log pipeline
- Track loaded kernel modules and alert on sctp module load events on hosts where SCTP is not required
- Baseline normal SCTP association lifetimes and alert on anomalous rollback frequency between COOKIE_ECHOED and COOKIE_WAIT states
How to Mitigate CVE-2026-52924
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 1d4652f6, 2afc9e68, 3c0741a4, 83ade59e, 84b7a319, a6207349, e374b22e, and f46e1d1a
- Track distribution security advisories and stage kernel updates across exposed hosts
- Disable the sctp kernel module on systems that do not require SCTP transport
Patch Information
The upstream fix fully purges the association outqueue when handling the Stale Cookie case. Dropping all pending transmit and retransmit state invalidates any scheduler cached pointers before sctp_stream_update() rebuilds the stream table. Updating only stream->out_curr was rejected because queued data would still reference the freed stream state. The fix is distributed across multiple stable branches via the commits listed above.
Workarounds
- Blacklist the SCTP module by adding install sctp /bin/true to /etc/modprobe.d/ on hosts that do not need SCTP
- Restrict SCTP traffic at the network perimeter using firewall rules that drop IP protocol number 132 from untrusted sources
- Limit SCTP socket access to trusted user namespaces and reduce attack surface via seccomp filters where feasible
# Disable the SCTP kernel module on hosts that do not require it
echo 'install sctp /bin/true' | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true
# Drop inbound SCTP (IP protocol 132) at the host firewall
sudo iptables -A INPUT -p 132 -j DROP
sudo ip6tables -A INPUT -p 132 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
