CVE-2026-52924

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to June 2026

Description A use-after-free flaw exists in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The issue occurs within the sctp sf do 5 2 6 stale() function when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. In this scenario, the association is rolled back from COOKIE ECHOED to COOKIE WAIT, and while sctp stream update() replaces the stream table, it fails to invalidate the stream->out curr variable. Consequently, out curr may point to a freed sctp stream out entry. Subsequent SCTP scheduler dequeue paths that rely on stream->out curr->ext can trigger a use-after-free condition after the old stream state is released via sctp stream free(). A remote attacker could exploit this by sending specially crafted SCTP packets, potentially leading to a system crash, Denial of Service (DoS), or local root privilege escalation.

Recommendations Update the Linux kernel to a version released after June 2026 to ensure the association outqueue is fully purged during Stale Cookie handling. As a temporary mitigation, restrict the use of the SCTP module to minimize the risk of exploitation.