CVE-2026-52929: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52929 Overview

CVE-2026-52929 is a Linux kernel vulnerability in the Stream Control Transmission Protocol (SCTP) stream handling code. When an ADD_OUT_STREAMS request is denied, SCTP only shrinks the queued chunks and lowers outcnt, leaving removed stream metadata behind. A later re-add operation can reuse a stale ext pointer and trigger a null-pointer dereference in the scheduler get path. The flaw affects the SCTP stream scheduler private RR, FC, and PRIO lists, which are left inconsistent after a denied rollback. The fix tears down the removed stream state the same way other stream resizes do, ensuring full rollback of denied outgoing stream additions.

Critical Impact
A null-pointer dereference in the SCTP scheduler path can lead to a kernel crash and local denial of service on affected Linux systems.

Affected Products

Linux kernel (mainline) versions containing the SCTP stream ADD_OUT_STREAMS rollback logic
Distributions shipping the unpatched SCTP module
Systems with SCTP enabled and reachable via configured associations

Discovery Timeline

2026-06-24 - CVE-2026-52929 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52929

Vulnerability Analysis

The vulnerability resides in the SCTP stream reconfiguration logic of the Linux kernel. SCTP supports dynamic stream additions through the ADD_OUT_STREAMS reconfiguration request. When the local endpoint denies the request, the original code path only shrinks the queued chunks and lowers outcnt. It does not tear down the associated stream extension (ext) state.

The stale extension state persists in the scheduler's private lists. These lists back the Round Robin (RR), Fair Capacity (FC), and Priority (PRIO) stream schedulers. A subsequent stream re-add reuses the leftover slot but encounters a stale ext reference. The scheduler get path then dereferences a null pointer, causing a kernel oops.

Root Cause

The root cause is an incomplete rollback in the denied ADD_OUT_STREAMS path. The code lowered outcnt without unscheduling the removed streams or invoking sctp_stream_outq_migrate() to drop the removed stream ext state. This left scheduler-private data structures inconsistent with the visible stream array, classifying the flaw as a Null Pointer Dereference in kernel code.

Attack Vector

An attacker with the ability to negotiate SCTP associations and trigger stream reconfiguration sequences can drive the association through an add-then-deny-then-re-add pattern. The denied rollback leaves the scheduler state poisoned. The next re-add operation triggers the dereference in the scheduler get path, panicking the kernel and producing a denial of service.

No verified public exploitation code is available. The vulnerability mechanism is documented in the upstream kernel commits referenced below.

Detection Methods for CVE-2026-52929

Indicators of Compromise

Kernel oops or panic messages referencing sctp_stream, sctp_sched, or null-pointer dereferences originating from the SCTP scheduler get path
Repeated SCTP RECONF chunks negotiating ADD_OUT_STREAMS followed by denial responses on a single association
Unexpected kernel crashes on hosts running SCTP-based workloads such as Diameter, SS7-over-IP, or telephony signaling

Detection Strategies

Monitor dmesg and kernel ring buffer logs for SCTP-related call traces and BUG: kernel NULL pointer dereference entries
Inspect SCTP association statistics via ss --sctp and /proc/net/sctp/ for abnormal stream reconfiguration counts
Audit running kernel versions across the fleet against the patched commit hashes to identify unpatched hosts

Monitoring Recommendations

Forward kernel logs to a central log aggregator and alert on sctp_ symbols appearing in oops backtraces
Enable kernel crash dumping (kdump) on SCTP-dependent hosts to capture root-cause evidence
Track SCTP RECONF chunk volume per association and flag anomalous add-stream churn

How to Mitigate CVE-2026-52929

Immediate Actions Required

Apply the upstream kernel patches that fully roll back denied add-stream state by calling sctp_stream_outq_migrate() and rescheduling remaining streams
Identify hosts with the sctp module loaded using lsmod | grep sctp and prioritize patching
If SCTP is not required, blacklist the module to remove the attack surface entirely

Patch Information

The fix unschedules the current scheduler state, drops the removed stream ext state via sctp_stream_outq_migrate(), and reschedules the remaining streams. This keeps the RR, FC, and PRIO scheduler-private lists consistent with the stream array. Patched commits are available in the upstream stable trees, including commit 39dc2b0e and commit 9662eb04. Additional backports are listed in the Linux kernel stable tree.

Workarounds

Disable the sctp kernel module on hosts that do not require SCTP connectivity
Restrict SCTP traffic at the network boundary using firewall rules to trusted peers only
Limit the ability of untrusted processes to create SCTP sockets through seccomp or LSM policies

bash

# Configuration example: prevent the SCTP module from loading
echo 'install sctp /bin/true' | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true
lsmod | grep sctp