CVE-2026-52924: Linux kernel SCTP use-after-free on stale COOKIE-ECHO handling
A use-after-free flaw in the Linux kernel SCTP stack can occur when a Stale Cookie error rolls an association back to COOKIE_WAIT while queued data still references the old stream state. The record assigns a CNA CVSS 3.1 score of 9.8 and lists eight upstream fix commits. No confirmed exploitation appears in the sources consulted.
Overview
The record describes a use-after-free in the Linux kernel SCTP implementation. A Stale Cookie ERROR received during association setup can roll an association from COOKIE_ECHOED back to COOKIE_WAIT while user data is already queued, leaving a cached scheduler pointer (stream->out_curr) referring to freed stream state. The upstream fix purges the association outqueue during Stale Cookie handling.
Impact
- The CNA-provided CVSS 3.1 score is 9.8 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A second provider lists 8.8 under CVSS 3.1.
- The weakness is classified as CWE-416 (Use After Free).
- The record reports KASAN slab-use-after-free crashes in SCTP scheduler dequeue paths. The record does not state a confirmed code execution or data disclosure outcome.
Affected products and versions
The record lists the product Linux Linux Kernel with these ranges:
- ≥ 4.15 and < 5.10.259
- ≥ 5.11 and < 5.15.210
- ≥ 5.16 and < 6.1.176
- ≥ 6.2 and < 6.6.143
- ≥ 6.7 and < 6.12.94
- ≥ 6.13 and < 6.18.36
- ≥ 6.19 and < 7.0.13
- version 7.1-rc1 through version 7.1-rc6, listed individually
No fixed version is named explicitly in the record. The upper bounds of the ranges suggest the first unaffected builds on each stable branch, but this is an inference to verify against the upstream commits.
Exploitation status
The record marks the vulnerability as not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted for this analysis.
Remediation and mitigation
- Update to a stable kernel release for your branch that includes the upstream commits listed in the record, or to a vendor kernel that incorporates them.
- Prioritize internet-facing or multi-tenant hosts where SCTP is enabled, given the network attack vector in the CVSS vector.
- If SCTP is not needed, the record does not describe a specific workaround. Restricting the SCTP module is a general hardening option to evaluate with your platform team.
- Track Red Hat errata and CSAF data referenced in the record for distribution-specific status.
Detection guidance
- Review kernel logs for KASAN or slab-use-after-free reports that reference SCTP functions.
- Monitor for unexplained SCTP association resets or kernel crashes on hosts that use SCTP.
- Build an inventory of kernels in the listed ranges to focus patch verification.
Limitations of the available information
- The record has no title, so the title in this analysis is derived from the description.
- No EPSS or SSVC data is present.
- The record does not state a fixed version for each branch or distribution.
- The exact network conditions needed to reach the vulnerable path beyond the CVSS vector are not detailed.
- The two CVSS scores differ; the record does not explain the difference.
Frequently asked questions
What causes CVE-2026-52924?
According to the record, a Stale Cookie error can roll an SCTP association back to COOKIE_WAIT while stream state is replaced but a cached scheduler pointer is not invalidated, which can lead to a use-after-free.
Is this vulnerability known to be exploited?
The record states the entry is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What should administrators do?
Review the affected kernel ranges, apply the stable or vendor kernel updates that include the upstream commits listed in the record, and verify your distribution's advisories.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.