CVE-2026-52924

What it actually does

This is a Linux kernel SCTP use-after-free in association setup/restart handling. When an SCTP association in COOKIE_ECHOED state receives a Stale Cookie ERROR, the kernel rolls the association back to COOKIE_WAIT and rebuilds SCTP stream state. In the vulnerable path, queued outbound data and scheduler state can still reference the old freed stream table, including the cached outbound stream pointer. Later SCTP dequeue or retransmission logic can dereference that stale pointer in scheduler paths such as FCFS, round-robin, or priority scheduling, causing a kernel memory safety violation. The most likely practical impact is a kernel crash and denial of service; depending on kernel configuration, memory layout, and exploitability of the stale object, further impact cannot be categorically ruled out but is not indicated by the available exploit maturity.

Why it matters to the business

Systems that expose or actively use SCTP can be crashed by a crafted SCTP association workflow, causing service interruption for workloads that depend on the affected host or network function. This is especially relevant for telecom, signaling, clustered, or specialized networking environments where SCTP is enabled. Current public exploitation maturity is listed as none, EPSS is low at 0.00331, and it is not known to be in CISA KEV or ransomware campaigns, so urgency is lower than actively exploited kernel issues but still important for internet-facing or untrusted-network SCTP exposure.

How an attack unfolds

An attacker needs network reachability to an SCTP endpoint on a vulnerable Linux kernel. They initiate or manipulate an SCTP association so that user data becomes queued around the COOKIE-ECHO phase, then trigger the stale-cookie handling path by causing a Stale Cookie ERROR while the association is in COOKIE_ECHOED. The vulnerable kernel rolls the association back to COOKIE_WAIT and rebuilds stream state without fully purging pending outbound and retransmission queues. Subsequent SCTP scheduler dequeue processing may follow cached pointers into freed stream state, producing a use-after-free and typically a kernel oops, panic, or service-impacting crash.

How to fix it

Apply a Linux kernel update that includes the SCTP fix which purges the association outqueue during stale COOKIE-ECHO handling. If vendor package versions are used, install the fixed kernel build supplied by the Linux distribution or appliance vendor and reboot into the updated kernel. Where immediate patching is not possible, reduce exposure by disabling SCTP if not required, blocking SCTP at network boundaries and host firewalls, restricting SCTP access to trusted peers, and reviewing services or kernel modules that enable SCTP. Because no specific affected product list or fixed package versions were provided, use the operating system vendor advisory and kernel changelog to identify the exact fixed release for each supported platform.

How to confirm the fix worked

Confirm the running kernel, not just the installed package, contains the fix by checking the active kernel version after reboot and comparing it with the vendor advisory or upstream stable kernel containing the SCTP outqueue purge change. Verify SCTP exposure by checking whether SCTP modules are loaded, whether SCTP sockets are listening, and whether firewalls permit IP protocol 132. Confirm mitigations by testing from an untrusted network segment that SCTP traffic is blocked or that SCTP services are no longer reachable. For source-based kernels, confirm the SCTP stale-cookie path includes logic to purge pending transmit/retransmit queue state before stream state is rebuilt.

Typical attack path

1. Identify a Linux host that has SCTP enabled and reachable over the network.
2. Open or manipulate an SCTP association with the target service.
3. Drive the association into the COOKIE_ECHOED state while outbound SCTP data is queued or bundled with COOKIE-ECHO handling.
4. Trigger stale-cookie processing by causing or sending a Stale Cookie ERROR condition.
5. Force later SCTP outbound queue flushing, retransmission, or scheduler dequeue activity.
6. Cause the kernel to dereference freed SCTP stream state, leading to a crash or denial of service.

How to detect it

Look for evidence of kernel instability associated with SCTP processing, especially around association setup, stale cookie handling, and SCTP scheduler dequeue paths. Useful sources include kernel logs, journalctl, dmesg, syslog, crash dump records, kdump/vmcore analysis, host monitoring alerts, firewall logs for SCTP traffic, and network telemetry that records IP protocol 132. Prioritize systems with unexpected reboots, kernel oops or panic events, SCTP service interruptions, or repeated SCTP association failures. Search for KASAN, slab-use-after-free, general protection fault, NULL or invalid pointer dereference, and stack traces involving SCTP functions such as sctp_sched_fcfs_dequeue, sctp_outq_flush, sctp_do_sm, sctp_assoc_bh_rcv, sctp_inq_push, or sctp_rcv. Network-side detection should look for unusual bursts of SCTP association setup traffic, COOKIE-ECHO activity, and Stale Cookie ERROR conditions from untrusted peers. There are no known named threat actors or public exploit campaigns in the supplied intelligence, so detections should focus on behavioral and crash artifacts rather than actor-specific infrastructure.

• BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue
• slab-use-after-free in sctp_sched_fcfs_dequeue
• sctp_sched_fcfs_dequeue
• sctp_outq_flush
• sctp_do_sm
• sctp_assoc_bh_rcv
• sctp_inq_push
• sctp_rcv
• sctp_sf_do_5_2_6_stale
• COOKIE_ECHOED
• COOKIE_WAIT
• COOKIE-ECHO
• Stale Cookie
• SCTP Stale Cookie
• protocol 132
• IP protocol 132
• kernel panic.*sctp
• kernel oops.*sctp
• general protection fault.*sctp

What your security team should do

• Inventory Linux systems that use or expose SCTP, prioritizing internet-facing hosts, telecom/signaling systems, load balancers, network appliances, and clustered services.
• Patch affected kernels through the operating system or appliance vendor and reboot to activate the fixed kernel.
• If SCTP is not required, disable SCTP support and block IP protocol 132 at perimeter, cloud security group, host firewall, and internal segmentation layers.
• If SCTP is required, restrict access to known trusted peers and monitor for abnormal association setup failures, stale-cookie errors, and kernel crash signatures.
• Review kernel logs, crash dumps, and monitoring data for SCTP-related use-after-free, oops, or panic messages since exposure began.
• Track vendor advisories because the CVE is relatively recent, published 48 days ago, and downstream backport version names may vary by distribution.