CVE-2026-52929

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SCTP implementation where the system fails to fully roll back the state when an ADD OUT STREAMS request is denied. In such cases, the system only shrinks queued chunks and lowers the outcnt variable, leaving behind removed stream metadata. This allows a subsequent re-addition attempt to reuse a stale extension, leading to a null-pointer dereference within the scheduler get path. A null-pointer dereference occurs when the software attempts to read from a memory address that is null, typically resulting in a system crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.