Yuqi

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to June 2026 **Description** A use-after-free flaw exists in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The issue occurs within the `sctp sf do 5 2 6 stale()` function when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. In this scenario, the association is rolled back from COOKIE ECHOED to COOKIE WAIT, and while `sctp stream update()` replaces the stream table, it fails to invalidate the `stream->out curr` variable. Consequently, `out curr` may point to a freed `sctp stream out` entry. Subsequent SCTP scheduler dequeue paths that rely on `stream->out curr->ext` can trigger a use-after-free condition after the old stream state is released via `sctp stream free()`. A remote attacker could exploit this by sending specially crafted SCTP packets, potentially leading to a system crash, Denial of Service (DoS), or local root privilege escalation. **Recommendations** Update the Linux kernel to a version released after June 2026 to ensure the association outqueue is fully purged during Stale Cookie handling. As a temporary mitigation, restrict the use of the SCTP module to minimize the risk of exploitation.