CVE-2026-52924

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: purge outqueue on stale COOKIE-ECHO handling

sctp_stream_update() is only invoked when the association is moved into

COOKIE_WAIT during association setup/reconfiguration. In this path, the

outbound stream scheduler state (stream->out_curr) is expected to be

clean, since no user data should have been transmitted yet unless the

state machine has already partially progressed.

However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a

Stale Cookie ERROR is received, the association is rolled back from

COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already

have been queued and even bundled with the COOKIE-ECHO chunk.

During the rollback, sctp_stream_update() frees the old stream table

and installs a new one, but it does not invalidate stream->out_curr.

As a result, out_curr may still point to a freed sctp_stream_out

entry from the previous stream state.

Later, SCTP scheduler dequeue paths (F

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References