CVE-2026-52924

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending specially crafted SCTP packets. This could lead to a system crash, causing a Denial of Service (DoS).

A use after free can occur in the SCTP stale COOKIE-ECHO handling path when a Stale Cookie ERROR rolls an association back from COOKIE_ECHOED to COOKIE_WAIT while user data is already queued or bundled with COOKIE-ECHO. The stream update path can free the old stream state, while scheduler cached state such as stream out_curr or queued transmit state can still reference the freed sctp_stream_out entry. Later SCTP dequeue paths such as FCFS, RR, or PRIO may dereference the stale stream state and crash the kernel. The issue is network reachable but AC:H is used because the trigger depends on a specific association setup and stale cookie rollback sequence. Impact is remote denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.