Executive brief
A vulnerability in the Linux kernel's SCTP networking protocol could allow a remote attacker to crash the system. SCTP is a protocol used for transporting data over networks, often in telecommunications and specialized data environments. By sending a specific sequence of connection messages that trigger a 'stale cookie' error, an attacker can cause the system to reference memory that has already been freed, leading to a kernel crash and a denial-of-service condition.
Technical details
A use-after-free vulnerability exists in the Linux kernel's SCTP implementation within the `sctp_sf_do_5_2_6_stale()` function. When a 'Stale Cookie' ERROR is received, the association state is rolled back from COOKIE_ECHOED to COOKIE_WAIT. During this rollback, `sctp_stream_update()` frees the existing stream table but fails to invalidate the `stream->out_curr` pointer. If user data was already queued or bundled with the COOKIE-ECHO chunk, the SCTP scheduler (FCFS, RR, PRIO) may later attempt to access the freed stream state through this stale pointer. This results in a kernel panic (detected by KASAN as a slab-use-after-free). The fix involves explicitly purging the association outqueue during stale cookie handling to ensure all pending transmit state and cached pointers are invalidated.
Affected products
- Linux Linux Kernel 7.1.0-rc1-00305-gbd3a4795d574
Timeline
- 2026-06-03: other: Patch authored
- 2026-06-19: patched: Patch committed to stable tree
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0
- https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc
- https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8
- https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f
- https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285
- https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5
- https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb