Skip to main content

Linux Kernel CVE-2026-52924

| EUVDEUVD-2026-38727 CRITICAL
Expired Pointer Dereference (CWE-825)
2026-06-24 Linux GHSA-v4hw-q98x-8jmm
Denial Of Service Linux
Critical
Disputed · 9.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Reach host with SCTP socket
  2. Delivery
    Initiate SCTP association
  3. Exploit
    Advance to COOKIE_ECHOED with queued data
  4. Install
    Send Stale Cookie ERROR
  5. C2
    Rollback frees stream table, leaves dangling out_curr
  6. Execute
    Scheduler dequeue reads freed memory
  7. Impact
    Kernel use-after-free panic (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-825
ASVS 5.0
V15 - Secure Coding and Architecture Expired pointer prevention
Exploitation Conditions

Exploitation requires the target to have the SCTP protocol module loaded and an SCTP socket reachable by the attacker - SCTP is not enabled by default on most general-purpose deployments, which is the primary limiting factor. The attacker must drive an SCTP association into the COOKIE_ECHOED state with user data already queued (or bundled with the COOKIE-ECHO chunk), then deliver a Stale Cookie ERROR to trigger the sctp_sf_do_5_2_6_stale() rollback into COOKIE_WAIT; this means the attacker must control or spoof the responding peer during handshake. No authentication is required (CVSS PR:N), but the dependence on a precise handshake state transition makes this a non-trivial, timing-sensitive condition rather than a single unsolicited packet against a default configuration.
Impact

Signals conflict sharply and should be reconciled before prioritizing. NVD scores this 9.8 critical with AV:N/AC:L/PR:N/UI:N and full C/I/A:H, which would imply trivial remote code execution; however the description, the 'Denial Of Service' tag, and the crash-style KASAN report all point to a remotely triggerable kernel panic (availability impact) rather than demonstrated code execution, and the trigger depends on a specific corner case of the SCTP state machine (the peer sending a Stale Cookie ERROR mid-handshake while data is queued), which is closer to high attack complexity than AC:L. EPSS reinforces low real-world urgency at 0.17% (6th percentile), there is no KEV listing and no public PoC. The dominant limiting factor is exposure: SCTP must be in use and reachable, which is uncommon outside telecom/SS7/Diameter and certain clustering workloads, so the practical attack surface is far narrower than the 9.8 suggests. Net assessment: a real remotely-triggerable DoS (and a theoretical UAF-to-escalation risk) that is high-severity where SCTP is exposed, but low priority for the large majority of deployments that do not load the SCTP module.
Exploit ScenarioDerived

An attacker able to act as (or spoof) the remote SCTP peer initiates an association to a target that has the SCTP module loaded and a listening SCTP socket, lets it reach COOKIE_ECHOED with user data queued/bundled, then sends a Stale Cookie ERROR to force a rollback to COOKIE_WAIT. The freed stream table leaves a dangling out_curr pointer that the scheduler dereferences on the next dequeue, panicking the kernel and denying service to all users of that host; no public PoC is known, and the timing/state requirements make this materially harder than a single crafted packet.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Use-after-free in the Linux kernel SCTP stack (net/sctp) allows a remote peer to crash the kernel by forcing an association to roll back from COOKIE_ECHOED to COOKIE_WAIT via a Stale Cookie ERROR. When sctp_stream_update() rebuilds the stream table during this rollback it leaves the scheduler's cached stream->out_curr pointer referencing freed memory, so the next scheduler dequeue (FCFS/RR/PRIO) dereferences a dangling sctp_stream_out entry. The flaw is tagged as Denial of Service, carries an NVD CVSS of 9.8, but has a low EPSS of 0.17% (6th percentile); no public exploit identified at time of analysis and it is not listed in CISA KEV.

RemediationAI

Vendor-released patch: upgrade to a fixed kernel point release - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 7.0.13, 6.18.36, or mainline 7.1, choosing the fixed release matching your branch - and reboot; the corresponding stable commits are at https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8 (and the sibling hashes listed in the references). For distribution kernels, apply the vendor kernel update that references CVE-2026-52924 rather than building from source. Where immediate patching is not possible, the most effective compensating control is to disable SCTP if it is not required: blacklist the module (e.g. 'install sctp /bin/true' in modprobe.d) so it cannot be auto-loaded, which fully removes the attack surface but breaks any SCTP-dependent application (common in telecom/SS7/Diameter stacks). If SCTP is needed, restrict SCTP reachability with firewall rules (block IP protocol 132 from untrusted networks) and limit peers to trusted endpoints - this reduces but does not eliminate risk from a malicious or spoofing peer, since the trigger comes from a peer-sent Stale Cookie ERROR during association setup.

Affected VersionsENISA

Linux 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 <3c0741a441a7df7099d7ca6a64a6a0de09c677c8
Linux patch: 6.6.143
Linux patch: 7.0.13
Linux 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 <1d4652f677906a64487c13f9ace54b0eb263b5d0
Linux 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 <83ade59e5da365f4bf8bce72c5a38774202b442f
Linux patch: 0
Linux patch: 6.1.176
Linux 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 <2afc9e684dc7fecf73db1edc937ebbc47b4b68dc
Linux 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 <e374b22e9b07b72a25909621464ff74096151bfb
Linux patch: 7.1
Linux 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 <f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8
Linux patch: 5.15.210
Linux 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 <a6207349e703cfc04756a4d16dec9176135813a5
Linux patch: 6.12.94
Linux patch: 6.18.36
Linux 4.15
Linux 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 <84b7a319105db2f917ccdcf502bdc866082b1285
Linux patch: 5.10.259

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in the kernel's SCTP (Stream Control Transmission Protocol, RFC 9260) transport implementation, specifically the 4-way COOKIE handshake state machine and the outbound stream scheduler. During association setup the handler sctp_sf_do_5_2_6_stale() processes a received Stale Cookie ERROR by rolling the association back from COOKIE_ECHOED to COOKIE_WAIT and calling sctp_stream_update(), which frees the old per-stream output table (sctp_stream_out) and installs a new one. Because user data and even data bundled with the COOKIE-ECHO chunk may already have been queued, the scheduler's cached pointer stream->out_curr is left pointing at the freed entry; subsequent dequeue paths read out_curr->ext, producing a slab-use-after-free (KASAN-confirmed) - a classic CWE-416 Use-After-Free, though NVD lists the CWE as N/A. The fix fully purges the association outqueue during the stale-cookie path so all pending transmit/retransmit state and cached scheduler pointers are invalidated before the stream state is rebuilt. CPE coverage is the generic cpe:2.3:a:linux:linux:*, so affected scope is the upstream kernel codebase rather than a single distribution.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.9 MEDIUM

Remotely triggerable (AV:N, PR:N) but needs a precise SCTP handshake/state-machine race with queued data (AC:H); demonstrated impact is a kernel crash, so A:H with C/I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.0 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Red Hat 7.0 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 24, 2026 - 09:16 EUVD
CVE Published
Jun 24, 2026 - 07:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 07:14 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sctp: purge outqueue on stale COOKIE-ECHO handling

sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.

However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.

During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.

Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().

This results in crashes such as (reported by Yuqi):

BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10

Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.

Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.

Executive ViewAI

Why It Matters

A critical use-after-free vulnerability in the Linux kernel SCTP stack (CVE-2026-52924) enables remote denial-of-service attacks that crash affected systems, impacting organizational availability for workloads relying on SCTP communications. Despite a critical 9.8 CVSS score, real-world exploitation risk remains low (0.2% EPSS) with no active exploitation currently observed, enabling a measured response through coordinated patching.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel runs everywhere, though the vulnerable SCTP module is rarely enabled
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-825 – Expired Pointer Dereference

View all
CVE-2025-49794 CRITICAL POC
9.1
CVE-2024-23310 CRITICAL POC
9.8
CVE-2025-49795 HIGH POC
7.5
CVE-2026-58592 HIGH POC
8.9
CVE-2019-15691 HIGH POC
7.2
CVE-2024-23638 MEDIUM POC
6.5
CVE-2026-53006 CRITICAL
9.8
CVE-2023-48694 CRITICAL
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149 Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-52924 ADVISORY https://seclists.org/oss-sec/2026/q3/665 ADVISORY https://seclists.org/oss-sec/2026/q3/678 ADVISORY https://ubuntu.com/security/notices/USN-8629-1 ADVISORY https://ubuntu.com/security/notices/USN-8630-1 ADVISORY https://ubuntu.com/security/notices/USN-8631-1 ADVISORY https://ubuntu.com/security/notices/USN-8633-1 ADVISORY https://ubuntu.com/security/notices/USN-8635-1 ADVISORY https://ubuntu.com/security/notices/USN-8636-1 ADVISORY https://vuldb.com/vuln/373183 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2840/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2841/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3044/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3089/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3156/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://access.redhat.com/errata/RHSA-2026:59723 REF https://access.redhat.com/errata/RHSA-2026:59737 REF https://access.redhat.com/errata/RHSA-2026:59821 REF https://access.redhat.com/errata/RHSA-2026:67471 REF https://access.redhat.com/security/cve/CVE-2026-52924 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492095 REF https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0 REF https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc REF https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8 REF https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f REF https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285 REF https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5 REF https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb REF https://git.kernel.org/stable/c/f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52924.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy