Junglewise Threat Intelligence

CVE-2026-52924: Linux Kernel use-after-free in SCTP stale COOKIE-ECHO handling

CVE-2026-52924 · Severity: info · CVSS 7.5 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's SCTP networking protocol could allow a remote attacker to crash the system. SCTP is a protocol used for transporting data over networks, often in telecommunications and specialized data environments. By sending a specific sequence of connection messages that trigger a 'stale cookie' error, an attacker can cause the system to reference memory that has already been freed, leading to a kernel crash and a denial-of-service condition.

Technical details

A use-after-free vulnerability exists in the Linux kernel's SCTP implementation within the `sctp_sf_do_5_2_6_stale()` function. When a 'Stale Cookie' ERROR is received, the association state is rolled back from COOKIE_ECHOED to COOKIE_WAIT. During this rollback, `sctp_stream_update()` frees the existing stream table but fails to invalidate the `stream->out_curr` pointer. If user data was already queued or bundled with the COOKIE-ECHO chunk, the SCTP scheduler (FCFS, RR, PRIO) may later attempt to access the freed stream state through this stale pointer. This results in a kernel panic (detected by KASAN as a slab-use-after-free). The fix involves explicitly purging the association outqueue during stale cookie handling to ensure all pending transmit state and cached pointers are invalidated.

Affected products

  • Linux Linux Kernel 7.1.0-rc1-00305-gbd3a4795d574

Timeline

  • 2026-06-03: other: Patch authored
  • 2026-06-19: patched: Patch committed to stable tree
  • 2026-06-24: disclosed: CVE published

References

Related threats