Use-After-Free Vulnerability in Linux Kernel SCTP Implementation

CVE-2026-52924

What is CVE-2026-52924?

A use-after-free vulnerability has been identified in the Stream Control Transmission Protocol (SCTP) implementation of the Linux kernel. This issue occurs when a Stale Cookie ERROR is received, leading to a rollback of the association from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already be queued alongside the COOKIE-ECHO chunk. When sctp_stream_update() is called during this process, it does not invalidate stream pointers properly, allowing access to freed memory. Consequently, this can result in crashes as seen in various applications. To rectify this vulnerability, it is crucial to completely purge the association's outqueue when handling Stale Cookie cases, ensuring that all pending transmissions are secured and the memory state is correctly managed.

References