Vulnerability-Lookup

CVE-2026-52924 (GCVE-0-2026-52924)

Vulnerability from cvelistv5 – Published: 2026-06-24 07:14 – Updated: 2026-09-15 12:04

Title

sctp: purge outqueue on stale COOKIE-ECHO handling

Summary

In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-825 - Expired Pointer Dereference

Assigner

Linux mitre root

References

15 references

URL	Tags
https://git.kernel.org/stable/c/84b7a319105db2f91…
https://git.kernel.org/stable/c/f46e1d1a758878f0d…
https://git.kernel.org/stable/c/3c0741a441a7df709…
https://git.kernel.org/stable/c/2afc9e684dc7fecf7…
https://git.kernel.org/stable/c/1d4652f677906a644…
https://git.kernel.org/stable/c/a6207349e703cfc04…
https://git.kernel.org/stable/c/83ade59e5da365f4b…
https://git.kernel.org/stable/c/e374b22e9b07b72a2…
https://access.redhat.com/security/cve/CVE-2026-52924	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492095	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:67471	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59723	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59821	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59737	vendor-advisoryx_refsource_REDHAT

Impacted products

9 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < 84b7a319105db2f917ccdcf502bdc866082b1285 (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8 (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < 3c0741a441a7df7099d7ca6a64a6a0de09c677c8 (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < 2afc9e684dc7fecf73db1edc937ebbc47b4b68dc (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < 1d4652f677906a64487c13f9ace54b0eb263b5d0 (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < a6207349e703cfc04756a4d16dec9176135813a5 (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < 83ade59e5da365f4bf8bce72c5a38774202b442f (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < e374b22e9b07b72a25909621464ff74096151bfb (git)	guessed
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)	guessed
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.158.1.rt7.499.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.158.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.42.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.158.1.rt7.499.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.158.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.42.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Stream Control Transmission Protocol (SCTP) implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending specially crafted SCTP packets. This could lead to a system crash, causing a Denial of Service (DoS)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-825",
                "description": "Expired Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:04:22.929Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-52924"
          },
          {
            "name": "RHBZ#2492095",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52924.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67471"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59723"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59821"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59737"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:67471: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59723: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59821: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59737: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: sctp: purge outqueue on stale COOKIE-ECHO handling",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "84b7a319105db2f917ccdcf502bdc866082b1285",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "3c0741a441a7df7099d7ca6a64a6a0de09c677c8",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "2afc9e684dc7fecf73db1edc937ebbc47b4b68dc",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "1d4652f677906a64487c13f9ace54b0eb263b5d0",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "a6207349e703cfc04756a4d16dec9176135813a5",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "83ade59e5da365f4bf8bce72c5a38774202b442f",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "e374b22e9b07b72a25909621464ff74096151bfb",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: purge outqueue on stale COOKIE-ECHO handling\n\nsctp_stream_update() is only invoked when the association is moved into\nCOOKIE_WAIT during association setup/reconfiguration. In this path, the\noutbound stream scheduler state (stream-\u003eout_curr) is expected to be\nclean, since no user data should have been transmitted yet unless the\nstate machine has already partially progressed.\n\nHowever, a corner case exists in sctp_sf_do_5_2_6_stale(): when a\nStale Cookie ERROR is received, the association is rolled back from\nCOOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already\nhave been queued and even bundled with the COOKIE-ECHO chunk.\n\nDuring the rollback, sctp_stream_update() frees the old stream table\nand installs a new one, but it does not invalidate stream-\u003eout_curr.\nAs a result, out_curr may still point to a freed sctp_stream_out\nentry from the previous stream state.\n\nLater, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on\nstream-\u003eout_curr-\u003eext, which can lead to use-after-free once the old\nstream state has been released via sctp_stream_free().\n\nThis results in crashes such as (reported by Yuqi):\n\n  BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140\n  Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312\n  CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted\n     7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)\n   sctp_sched_fcfs_dequeue+0x13a/0x140\n   sctp_outq_flush+0x1603/0x33e0\n   sctp_do_sm+0x31c9/0x5d30\n   sctp_assoc_bh_rcv+0x392/0x6f0\n   sctp_inq_push+0x1db/0x270\n   sctp_rcv+0x138d/0x3c10\n\nFix this by fully purging the association outqueue when handling the\nStale Cookie case. This ensures all pending transmit and retransmit\nstate is dropped, and any scheduler cached pointers are invalidated,\nmaking it safe to rebuild stream state during COOKIE_WAIT restart.\n\nUpdating only stream-\u003eout_curr would be insufficient, since queued\nand retransmittable data would still reference the old stream state and\ntrigger later use-after-free in dequeue paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable SCTP state-machine path is reached by received SCTP packets, specifically an ERROR chunk with a Stale Cookie cause sent by the remote SCTP peer during COOKIE_ECHOED handling.\nAC:L - A malicious SCTP peer can drive the required handshake state and send the stale-cookie ERROR; no race or hard-to-control kernel condition is required once data has been queued for COOKIE-ECHO bundling.\nPR:N - The triggering packet is accepted from the network after SCTP verification-tag checks, but those are protocol state checks rather than authentication or privileges. No local account or administrative capability is required for a remote peer.\nUI:N - Exploitation does not require a human user action; it can occur during normal SCTP association setup and data transmission with a malicious peer.\nS:U - The impact is within the Linux kernel networking stack on the same system and does not cross a separate security authority such as a hypervisor or sandbox boundary.\nC:H - The bug leaves stream-\u003eout_curr pointing at freed stream state, creating a use-after-free in scheduler dequeue paths. Per kernel CVSS guidance, use-after-free memory corruption can be leveraged for high confidentiality impact.\nI:H - The stale pointer use-after-free is kernel heap memory corruption and may be exploitable beyond a crash via heap manipulation. Per the required guidance, UAFs warrant high integrity impact.\nA:H - The reported failure is a KASAN slab-use-after-free in SCTP dequeue leading to a kernel crash/oops. This provides high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:45.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285"
        },
        {
          "url": "https://git.kernel.org/stable/c/f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb"
        }
      ],
      "title": "sctp: purge outqueue on stale COOKIE-ECHO handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52924",
    "datePublished": "2026-06-24T07:14:18.646Z",
    "dateReserved": "2026-06-09T07:44:35.368Z",
    "dateUpdated": "2026-09-15T12:04:22.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-52924",
      "date": "2026-09-23",
      "epss": "0.00438",
      "percentile": "0.37565"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T02:01:01.000Z",
      "cve": "CVE-2026-52924",
      "id": "msrc_CVE-2026-52924",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "sctp: purge outqueue on stale COOKIE-ECHO handling",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-52924.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sctp/sm_statefuns.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "84b7a319105db2f917ccdcf502bdc866082b1285",
                    "status": "affected",
                    "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8",
                    "status": "affected",
                    "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3c0741a441a7df7099d7ca6a64a6a0de09c677c8",
                    "status": "affected",
                    "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2afc9e684dc7fecf73db1edc937ebbc47b4b68dc",
                    "status": "affected",
                    "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1d4652f677906a64487c13f9ace54b0eb263b5d0",
                    "status": "affected",
                    "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a6207349e703cfc04756a4d16dec9176135813a5",
                    "status": "affected",
                    "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "83ade59e5da365f4bf8bce72c5a38774202b442f",
                    "status": "affected",
                    "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e374b22e9b07b72a25909621464ff74096151bfb",
                    "status": "affected",
                    "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sctp/sm_statefuns.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.15"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.94",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.36",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:enterprise_linux:8::nfv"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel-rt",
                "product": "Red Hat Enterprise Linux 8",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:4.18.0-553.158.1.rt7.499.el8_10",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:8"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 8",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:4.18.0-553.158.1.el8_10",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:enterprise_linux:9",
                  "cpe:/o:redhat:enterprise_linux:9"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 9",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:5.14.0-687.42.1.el9_8",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:10"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 10",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:6"
                ],
                "defaultStatus": "unaffected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 6",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:7"
                ],
                "defaultStatus": "unaffected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 7",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:7"
                ],
                "defaultStatus": "unaffected",
                "packageName": "kernel-rt",
                "product": "Red Hat Enterprise Linux 7",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:9"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel-rt",
                "product": "Red Hat Enterprise Linux 9",
                "vendor": "Red Hat"
              }
            ],
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E2E6634B-DED7-40B3-A18B-2140A791419F",
                    "versionEndExcluding": "5.10.259",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
                    "versionEndExcluding": "5.15.210",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
                    "versionEndExcluding": "6.1.176",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
                    "versionEndExcluding": "6.6.143",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9",
                    "versionEndExcluding": "6.12.94",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3",
                    "versionEndExcluding": "6.18.36",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E",
                    "versionEndExcluding": "7.0.13",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: purge outqueue on stale COOKIE-ECHO handling\n\nsctp_stream_update() is only invoked when the association is moved into\nCOOKIE_WAIT during association setup/reconfiguration. In this path, the\noutbound stream scheduler state (stream-\u003eout_curr) is expected to be\nclean, since no user data should have been transmitted yet unless the\nstate machine has already partially progressed.\n\nHowever, a corner case exists in sctp_sf_do_5_2_6_stale(): when a\nStale Cookie ERROR is received, the association is rolled back from\nCOOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already\nhave been queued and even bundled with the COOKIE-ECHO chunk.\n\nDuring the rollback, sctp_stream_update() frees the old stream table\nand installs a new one, but it does not invalidate stream-\u003eout_curr.\nAs a result, out_curr may still point to a freed sctp_stream_out\nentry from the previous stream state.\n\nLater, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on\nstream-\u003eout_curr-\u003eext, which can lead to use-after-free once the old\nstream state has been released via sctp_stream_free().\n\nThis results in crashes such as (reported by Yuqi):\n\n  BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140\n  Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312\n  CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted\n     7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)\n   sctp_sched_fcfs_dequeue+0x13a/0x140\n   sctp_outq_flush+0x1603/0x33e0\n   sctp_do_sm+0x31c9/0x5d30\n   sctp_assoc_bh_rcv+0x392/0x6f0\n   sctp_inq_push+0x1db/0x270\n   sctp_rcv+0x138d/0x3c10\n\nFix this by fully purging the association outqueue when handling the\nStale Cookie case. This ensures all pending transmit and retransmit\nstate is dropped, and any scheduler cached pointers are invalidated,\nmaking it safe to rebuild stream state during COOKIE_WAIT restart.\n\nUpdating only stream-\u003eout_curr would be insufficient, since queued\nand retransmittable data would still reference the old stream state and\ntrigger later use-after-free in dequeue paths."
          }
        ],
        "id": "CVE-2026-52924",
        "lastModified": "2026-09-15T12:17:51.013",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-06-24T08:16:22.430",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:59723"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:59737"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:59821"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:67471"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-52924"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52924.json"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-825"
              }
            ],
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-15T11:25:32+00:00",
      "cve": "CVE-2026-52924",
      "id": "CVE-2026-52924",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sctp: purge outqueue on stale COOKIE-ECHO handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52924.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-19T01:54:46Z",
      "cve": "CVE-2026-52924",
      "id": "CVE-2026-52924",
      "initial_release_date": "2026-06-25T02:20:01Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "444",
      "product_status:known_not_affected": "125",
      "product_status:recommended": "545",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-52924",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-52924.json",
      "version": "17"
    }
  }
}

RLSA-2026:67471 (CVE-2025-40149)

Vulnerability from osv_rocky – Published: 2026-09-16 12:09 – Updated: 2026-09-23 18:11 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)
kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)
kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)
kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)
kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)
kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

Bug Fix(es) and Enhancement(s):

[rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:Rocky Linux-245035)
RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)
[Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255348)
[usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky Linux-10.2.z] (JIRA:Rocky Linux-256731)
RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:67471	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2414466	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2425039	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2454867	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2460699	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461451	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461462	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461525	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461575	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467084	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2468192	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2468244	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482566	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492095	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492747	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492771	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492779	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2497035	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502320	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502368	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502412	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502434	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502490	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513452	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513477	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2517010	REPORT
	https://access.redhat.com/errata/RHSA-2026:67471	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:10",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-10\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:6.12.0-211.55.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:67471"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)\n\n* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)\n\n* kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)\n\n* kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)\n\n* kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)\n\n* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)\n\n* kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)\n\n* kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)\n\n* kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)\n\n* kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)\n\n* kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)\n\n* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)\n\n* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)\n\n* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)\n\n* kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)\n\n* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)\n\n* kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)\n\n* kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)\n\n* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)\n\n* kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)\n\n* kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)\n\n* kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (CVE-2026-68426)\n\n* kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)\n\nBug Fix(es) and Enhancement(s):\n\n* [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling  (JIRA:Rocky Linux-245035)\n\n* RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)\n\n* [Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255348)\n\n* [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky Linux-10.2.z] (JIRA:Rocky Linux-256731)\n\n* RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:67471",
  "modified": "2026-09-23T18:11:15.025014Z",
  "published": "2026-09-16T12:09:37.746677Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:67471"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414466"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425039"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454867"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460699"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461451"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461525"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461575"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467084"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468192"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468244"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482566"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492747"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492771"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492779"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497035"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502320"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502368"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502412"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502434"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502490"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513452"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513477"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517010"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:67471"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2025-40149",
    "CVE-2025-68745",
    "CVE-2026-23466",
    "CVE-2026-31479",
    "CVE-2026-31539",
    "CVE-2026-31566",
    "CVE-2026-31656",
    "CVE-2026-31663",
    "CVE-2026-43248",
    "CVE-2026-43368",
    "CVE-2026-43370",
    "CVE-2026-46149",
    "CVE-2026-52924",
    "CVE-2026-53131",
    "CVE-2026-53239",
    "CVE-2026-53246",
    "CVE-2026-53361",
    "CVE-2026-63889",
    "CVE-2026-63917",
    "CVE-2026-63919",
    "CVE-2026-63921",
    "CVE-2026-64111",
    "CVE-2026-68264",
    "CVE-2026-68426",
    "CVE-2026-74556"
  ]
}

SUSE-SU-2026:22742-1

Vulnerability from csaf_suse - Published: 2026-07-21 08:27 - Updated: 2026-09-16 20:05

Summary

Security update for the Linux Kernel

Severity

Important

Scope

255 vulnerabilities in this advisory, including CVE-2026-52924.

CVE-2026-52924

7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2026:22769-1

Vulnerability from csaf_suse - Published: 2026-07-21 08:27 - Updated: 2026-09-16 20:05

Summary

Security update for the Linux Kernel

Severity

Important

Scope

255 vulnerabilities in this advisory, including CVE-2026-52924.

CVE-2026-52924

7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Recommended: 28 products

Open the full advisory

SUSE-SU-2026:22809-1

Vulnerability from csaf_suse - Published: 2026-07-22 13:38 - Updated: 2026-09-20 18:40

Summary

Security update for the Linux Kernel

Severity

Important

Scope

87 vulnerabilities in this advisory, including CVE-2026-52924.

CVE-2026-52924

7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Recommended: 4 products

Open the full advisory

SUSE-SU-2026:22810-1

Vulnerability from csaf_suse - Published: 2026-07-22 13:52 - Updated: 2026-09-20 18:40

Summary

Security update for the Linux Kernel

Severity

Important

Scope

87 vulnerabilities in this advisory, including CVE-2026-52924.

CVE-2026-52924

7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Recommended: 9 products

Open the full advisory

SUSE-SU-2026:22812-1

Vulnerability from csaf_suse - Published: 2026-07-21 08:27 - Updated: 2026-09-16 20:06

Summary

Security update for the Linux Kernel

Severity

Important

Scope

255 vulnerabilities in this advisory, including CVE-2026-52924.

CVE-2026-52924

7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Recommended: 9 products

Open the full advisory

SUSE-SU-2026:22835-1

Vulnerability from csaf_suse - Published: 2026-07-21 08:27 - Updated: 2026-09-16 20:06

Summary

Security update for the Linux Kernel

Severity

Important

Scope

255 vulnerabilities in this advisory, including CVE-2026-52924.

CVE-2026-52924

7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Recommended: 114 products

Open the full advisory

SUSE-SU-2026:22903-1

Vulnerability from csaf_suse - Published: 2026-07-22 11:01 - Updated: 2026-09-16 20:07

Summary

Security update for the Linux Kernel

Severity

Important

Scope

87 vulnerabilities in this advisory, including CVE-2026-52924.

CVE-2026-52924

7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Recommended: 7 products

Open the full advisory

SUSE-SU-2026:22904-1

Vulnerability from csaf_suse - Published: 2026-07-22 12:25 - Updated: 2026-09-16 20:07

Summary

Security update for the Linux Kernel

Severity

Important

Scope

87 vulnerabilities in this advisory, including CVE-2026-52924.

CVE-2026-52924

7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Recommended: 14 products

Open the full advisory

SUSE-SU-2026:2840-1

Vulnerability from csaf_suse - Published: 2026-07-10 09:24 - Updated: 2026-09-17 16:29

Summary

Security update for the Linux Kernel

Severity

Important

Scope

30 vulnerabilities in this advisory, including CVE-2026-52924.

CVE-2026-52924

7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Recommended: 3 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-52924 (GCVE-0-2026-52924)

RLSA-2026:67471 (CVE-2025-40149)

Tags

Sightings

Nomenclature

Related by attack behaviour