CVE-2026-52929
Received Received - Intake
SCTP Stream State Rollback Flaw in Linux Kernel

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-24
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-52929
EUVD
EUVD-2026-38699
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. When an attempt to add outgoing streams (ADD_OUT_STREAMS) is denied, the system only partially rolls back the changes by shrinking queued chunks and lowering the output count. However, it leaves behind removed stream metadata, which can later be reused in a way that causes a null-pointer dereference in the scheduler path. The fix involves fully rolling back the denied stream addition by properly tearing down the removed stream state, unscheduling the current scheduler state, dropping the removed stream extension state, and then rescheduling the remaining streams to maintain consistency.

Impact Analysis

This vulnerability can lead to a null-pointer dereference in the SCTP scheduler, which may cause the Linux kernel to crash or behave unpredictably. Such a crash could result in denial of service (DoS) conditions, potentially disrupting network communications or system stability on affected machines.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52929. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart