Executive brief
A vulnerability in the Linux kernel's networking component could allow an attacker to crash the system. The issue exists in the SCTP protocol, which is used for transporting data over networks. By triggering a specific sequence of stream requests, an attacker can cause the system to encounter a 'null-pointer dereference,' leading to a kernel crash and service outage.
Technical details
A vulnerability exists in the SCTP stream management logic (net/sctp/stream.c) of the Linux kernel. When an ADD_OUT_STREAMS request is denied, the kernel fails to fully roll back the stream state, leaving behind stale metadata. A subsequent attempt to re-add the stream can cause the scheduler to reuse this stale 'ext' state, resulting in a null-pointer dereference in the scheduler's get path. This issue affects priority-based stream schedulers (RR/FC/PRIO). The fix involves properly tearing down the removed stream state using sctp_stream_outq_migrate() and rescheduling remaining streams to maintain consistency.
Affected products
- Linux Linux Kernel 4.15 to 6.13
Timeline
- 2026-06-05: other: Vulnerability fixed in upstream kernel source
- 2026-06-24: disclosed: CVE-2026-52929 published
References
- https://git.kernel.org/stable/c/0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85
- https://git.kernel.org/stable/c/1c6773b8c081509dcd5cd2954f2b02c50c00f151
- https://git.kernel.org/stable/c/39dc2b0eb5371a669ebc9ec6072b9184eac95418
- https://git.kernel.org/stable/c/7dd9a42b044aad2dbe037db1c1e2943582485b44
- https://git.kernel.org/stable/c/9662eb0401518f0b4681f10e7fbf688f504f24cf
- https://git.kernel.org/stable/c/a5f8a90ac9f77c678a9781c0a464b635e0d63e49
- https://git.kernel.org/stable/c/a6724b7b812ac8793514a1d5938db5d9d29ae725