CVE-2026-52929

A flaw was found in the Linux kernel's SCTP stream scheduler. When transient outgoing streams are denied and torn down, the kernel fails to reclaim scheduler-specific metadata before an algorithm switch (e.g., WFQ to PRIO). The orphaned state - including internal accounting fields - becomes reachable through the new scheduler's accessors, allowing an unprivileged local attacker to read arbitrary kernel memory and corrupt kernel objects via SCTP_STREAM_SCHEDULER_VALUE socket options. This can be leveraged for local privilege escalation to full root capabilities. A failed exploitation attempt may also crash the kernel, resulting in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the sctp kernel module from loading. Create a file named /etc/modprobe.d/disable-sctp.conf with the following content:

install sctp /bin/true
blacklist sctp

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix.