Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
CVE-2026-52924 — Technical analysis of CVE-2026-52924, a critical use-after-free in Linux kernel SCTP stale cookie handling, including root cause, attack flow, fix, and detection methods. | Kitploit
Technical analysis of CVE-2026-52924, a critical use-after-free in Linux kernel SCTP stale cookie handling, including root cause, attack flow, fix, and detection methods.
The vulnerability occurs in the SCTP state machine's handling of stale COOKIE-ECHO packets. The issue involves improper cleanup of the outbound stream queue when an association is rolled back.
Attack Flow
Normal Operation: Association moves to COOKIE_ECHOED state
User Data Queued: Application sends data, which is queued for transmission
Stale Cookie Error: Remote peer sends a Stale Cookie error
Rollback Triggered: Association rolls back from COOKIE_ECHOED → COOKIE_WAIT
Stream State Updated:sctp_stream_update() frees old stream table, installs new one
Invalid Pointer:stream->out_curr still points to freed sctp_stream_out entry
Dequeue Access: When scheduler tries to dequeue (FCFS, RR, PRIO), it accesses out_curr->ext
Use-After-Free: Accessing freed memory → kernel crash via KASAN detection
Problematic Code Flow
root@kitploit:~
sctp_sf_do_5_2_6_stale():
├─ Receive Stale Cookie error
├─ Rollback association state
└─ Call sctp_stream_update()
├─ Free old stream table
├─ Install new stream table
└─ BUG: stream->out_curr NOT invalidated ❌
Later when dequeuing:
sctp_sched_fcfs_dequeue():
└─ Access stream->out_curr->ext (FREED MEMORY) 💥
Crash Example
root@kitploit:~
BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140
Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312
CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)
Call trace:
sctp_sched_fcfs_dequeue+0x13a/0x140
sctp_outq_flush+0x1603/0x33e0
sctp_do_sm+0x31c9/0x5d30
sctp_assoc_bh_rcv+0x392/0x6f0
sctp_inq_push+0x1db/0x270
sctp_rcv+0x138d/0x3c10
Why Simply Updating out_curr Is Insufficient
A naive fix might be to just clear stream->out_curr:
root@kitploit:~
// INSUFFICIENT FIX ❌
stream->out_curr = NULL;
Problem: The outqueue still contains:
Queued data chunks referencing old stream state
Retransmit queue entries pointing to old streams
Control chunks bundled with old stream metadata
These stale references will still cause use-after-free when accessed.
The Correct Fix
Solution: Fully purge the association's outqueue during stale cookie handling.
root@kitploit:~
// CORRECT FIX ✓
sctp_outq_free(&asoc->outqueue);
This ensures:
All pending transmit data is dropped
All retransmit queue entries are freed
Scheduler cached pointers (out_curr, etc.) are invalidated
Stream state can be safely rebuilt during COOKIE_WAIT restart
No dangling references to freed stream entries
Implementation Location
File:net/sctp/sm_statefuns.c Function:sctp_sf_do_5_2_6_stale() Addition: Call sctp_outq_free(&asoc->outqueue) before sctp_stream_update()
root@kitploit:~
enum sctp_disposition sctp_sf_do_5_2_6_stale(...)
{
// ... existing code ...
// Purge outqueue before rebuilding stream state
sctp_outq_free(&asoc->outqueue);
// Now safe to update stream
sctp_stream_update(&asoc->stream, &asoc->c.h_init_tag);
// ... rest of function ...
}
Impact Analysis
Severity Factors (CVSS 9.8)
Attack Vector: Network (CVSS:3.1/AV:N)
Attack Complexity: Low (CVSS:3.1/AC:L)
Privileges Required: None (CVSS:3.1/PR:N)
User Interaction: None (CVSS:3.1/UI:N)
Scope: Unchanged (CVSS:3.1/S:U)
Confidentiality Impact: High (CVSS:3.1/C:H)
Integrity Impact: High (CVSS:3.1/I:H)
Availability Impact: High (CVSS:3.1/A:H)
Exploitation Requirements
Network access to target system (SCTP port open)
Ability to send SCTP packets to establish connection
Send Stale Cookie error at specific timing (COOKIE_ECHOED state)
Trigger scheduler dequeue operation
Attack Scenarios
Denial of Service: Crash kernel repeatedly → DoS
Information Disclosure: Read kernel memory via UAF
Privilege Escalation: Potential through memory manipulation
Remote Code Execution: Possible with memory corruption exploit
eliot-code/cve-2026-52924
