SCTP Stream State Rollback Flaw in Linux Kernel

Publication date: 2026-06-24

Last updated on: 2026-07-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-08

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52929

EUVD

EUVD-2026-38699

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 4.15 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. When an attempt to add outgoing streams (ADD_OUT_STREAMS) is denied, the system only partially rolls back the changes by shrinking queued chunks and lowering the output count. However, it leaves behind removed stream metadata, which can later be reused in a way that causes a null-pointer dereference in the scheduler path. The fix involves fully rolling back the denied stream addition by properly tearing down the removed stream state, unscheduling the current scheduler state, dropping the removed stream extension state, and then rescheduling the remaining streams to maintain consistency.

Impact Analysis

This vulnerability can lead to a null-pointer dereference in the SCTP scheduler, which may cause the Linux kernel to crash or behave unpredictably. Such a crash could result in denial of service (DoS) conditions, potentially disrupting network communications or system stability on affected machines.

Hi! I’m here to help you understand CVE-2026-52929. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70