CVE-2026-52924

.# CVE-2026-52924: SCTP Use-After-Free in Stale Cookie Handling

Vulnerability Summary

CVE ID: CVE-2026-52924
Severity: CRITICAL (CVSS 9.8)
Component: Linux Kernel - SCTP (Stream Control Transmission Protocol)
Type: Use-After-Free (CWE-416, CWE-825)
Published: 2026-06-24
Status: Fixed

Affected Versions

• Linux Kernel < 5.10.259
• Linux Kernel < 5.15.210
• Linux Kernel < 6.1.176
• Linux Kernel < 6.6.143
• Linux Kernel < 6.12.94
• Linux Kernel < 6.18.36
• Linux Kernel < 7.0.13
• Linux Kernel < 7.1

Technical Details

Root Cause

The vulnerability occurs in the SCTP state machine's handling of stale COOKIE-ECHO packets. The issue involves improper cleanup of the outbound stream queue when an association is rolled back.

Attack Flow

1. Normal Operation: Association moves to COOKIE_ECHOED state
2. User Data Queued: Application sends data, which is queued for transmission
3. Stale Cookie Error: Remote peer sends a Stale Cookie error
4. Rollback Triggered: Association rolls back from COOKIE_ECHOED → COOKIE_WAIT
5. Stream State Updated: sctp_stream_update() frees old stream table, installs new one
6. Invalid Pointer: stream->out_curr still points to freed sctp_stream_out entry
7. Dequeue Access: When scheduler tries to dequeue (FCFS, RR, PRIO), it accesses out_curr->ext
8. Use-After-Free: Accessing freed memory → kernel crash via KASAN detection

Problematic Code Flow

sctp_sf_do_5_2_6_stale():
  ├─ Receive Stale Cookie error
  ├─ Rollback association state
  └─ Call sctp_stream_update()
       ├─ Free old stream table
       ├─ Install new stream table
       └─ BUG: stream->out_curr NOT invalidated ❌

Later when dequeuing:
  sctp_sched_fcfs_dequeue():
    └─ Access stream->out_curr->ext  (FREED MEMORY) 💥

Crash Example

BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140
Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312
CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)

Call trace:
  sctp_sched_fcfs_dequeue+0x13a/0x140
  sctp_outq_flush+0x1603/0x33e0
  sctp_do_sm+0x31c9/0x5d30
  sctp_assoc_bh_rcv+0x392/0x6f0
  sctp_inq_push+0x1db/0x270
  sctp_rcv+0x138d/0x3c10

Why Simply Updating out_curr Is Insufficient

A naive fix might be to just clear stream->out_curr:

// INSUFFICIENT FIX ❌
stream->out_curr = NULL;

Problem: The outqueue still contains:

• Queued data chunks referencing old stream state
• Retransmit queue entries pointing to old streams
• Control chunks bundled with old stream metadata

These stale references will still cause use-after-free when accessed.

The Correct Fix

Solution: Fully purge the association's outqueue during stale cookie handling.

// CORRECT FIX ✓
sctp_outq_free(&asoc->outqueue);

This ensures:

1. All pending transmit data is dropped
2. All retransmit queue entries are freed
3. Scheduler cached pointers (out_curr, etc.) are invalidated
4. Stream state can be safely rebuilt during COOKIE_WAIT restart
5. No dangling references to freed stream entries

Implementation Location

File: net/sctp/sm_statefuns.c
Function: sctp_sf_do_5_2_6_stale()
Addition: Call sctp_outq_free(&asoc->outqueue) before sctp_stream_update()

enum sctp_disposition sctp_sf_do_5_2_6_stale(...)
{
    // ... existing code ...
    
    // Purge outqueue before rebuilding stream state
    sctp_outq_free(&asoc->outqueue);
    
    // Now safe to update stream
    sctp_stream_update(&asoc->stream, &asoc->c.h_init_tag);
    
    // ... rest of function ...
}

Impact Analysis

Severity Factors (CVSS 9.8)

• Attack Vector: Network (CVSS:3.1/AV:N)
• Attack Complexity: Low (CVSS:3.1/AC:L)
• Privileges Required: None (CVSS:3.1/PR:N)
• User Interaction: None (CVSS:3.1/UI:N)
• Scope: Unchanged (CVSS:3.1/S:U)
• Confidentiality Impact: High (CVSS:3.1/C:H)
• Integrity Impact: High (CVSS:3.1/I:H)
• Availability Impact: High (CVSS:3.1/A:H)

Exploitation Requirements

1. Network access to target system (SCTP port open)
2. Ability to send SCTP packets to establish connection
3. Send Stale Cookie error at specific timing (COOKIE_ECHOED state)
4. Trigger scheduler dequeue operation

Attack Scenarios

1. Denial of Service: Crash kernel repeatedly → DoS
2. Information Disclosure: Read kernel memory via UAF
3. Privilege Escalation: Potential through memory manipulation
4. Remote Code Execution: Possible with memory corruption exploit

Detection Methods

KASAN Detection (Runtime)

# Enable KASAN in kernel config
CONFIG_KASAN=y
CONFIG_KASAN_GENERIC=y

# Runtime output shows:
BUG: KASAN: slab-use-after-free

Static Analysis

# Look for unsafe stream->out_curr access without validation
grep -r "out_curr->ext" net/sctp/
grep -r "out_curr->" net/sctp/sched*.c

Network Detection

• Monitor for SCTP Stale Cookie ERROR packets (Type 3, Code 1)
• Track connection rollback patterns
• Alert on rapid COOKIE_ECHOED → COOKIE_WAIT transitions

Mitigation Strategies

Temporary Mitigations (Until Patched)

1. Disable SCTP: Remove SCTP module or block SCTP ports (132, 132 UDP)

   echo "install sctp /bin/true" >> /etc/modprobe.d/sctp-disable.conf
   

2. Firewall Rules: Block SCTP traffic at network boundary

   iptables -A INPUT -p sctp -j DROP
   

3. Kernel Version: Upgrade to patched versions

   • 5.10.259+
   • 5.15.210+
   • 6.1.176+
   • 6.6.143+
   • 6.12.94+
   • 6.18.36+
   • 7.0.13+
   • 7.1+ (latest)

Permanent Fix

Apply the kernel patch that calls sctp_outq_free() in sctp_sf_do_5_2_6_stale().

References

• CWE-416: Use After Free
• CWE-825: Expired Pointer Dereference
• CVSS Calculator: https://www.first.org/cvss/calculator/3.1
• NVD Entry: CVE-2026-52924
• Linux Kernel Security: https://www.kernel.org/doc/html/latest/security/

Testing Recommendations

Unit Tests

1. Verify sctp_outq_free() properly invalidates out_curr
2. Verify all queued data is freed during outq_free
3. Verify retransmit queue is cleared
4. Test scheduler behavior after outq purge

Integration Tests

1. Normal stale cookie recovery flow
2. Data in flight when stale cookie received
3. Multiple rapid stale cookies
4. Different SCTP schedulers (FCFS, RR, PRIO)

Fuzz Testing

1. Send SCTP packets with stale cookie errors
2. Vary timing of error injection
3. Vary amount of data in flight
4. Test with high load conditions

Timeline

• 2026-06-24: Vulnerability publicly disclosed
• Status: Fix available
• EPSS Score: 0.3% (27th percentile)
  • Low exploitation probability
  • Requires specific network conditions
  • Limited real-world exploits indexed

---

** Autor : Elliot Document Version: 1.0
Last Updated: 2026-09-07
Classification: Public Information