CVE-2026-52929: Linux SCTP Null-Pointer Dereference in Stream Rollback

Technical summary

CVE-2026-52929 is a null-pointer dereference vulnerability in the SCTP stream management subsystem of the Linux kernel. When an ADD_OUT_STREAMS request is denied, the kernel partially unwinds the operation by shrinking queued chunks and lowering the outcnt counter, but fails to fully tear down the stream extension metadata. This incomplete rollback leaves stale stream scheduler state in the RR (Round-Robin), FC (Fair-Capacity), and PRIO (Priority) lists. A subsequent ADD_OUT_STREAMS request can then reuse the stale ext structure, triggering a null-pointer dereference in the scheduler's get path. The fix implements a complete rollback by unscheduling the current scheduler state, calling sctp_stream_outq_migrate() to drop removed stream extensions, and rescheduling remaining streams. This ensures that scheduler-private lists remain consistent and prevents the dereference on re-add.

Business impact

Any system running a vulnerable Linux kernel that uses SCTP as a network transport can be remotely crashed by an attacker or even by legitimate applications mishandling stream negotiation. SCTP is used in telecommunications infrastructure (3GPP, diameter signaling), multimedia protocols, and some cluster interconnects. A remote denial-of-service attack requires no authentication or user interaction, allowing an attacker to disrupt service availability. Systems that rely on high availability or are exposed to untrusted networks face elevated risk.

Affected systems

All Linux kernel versions with the SCTP subsystem are potentially affected. The vulnerability lies in the stream negotiation logic used when ADD_OUT_STREAMS requests are denied, so any deployment running SCTP must assume vulnerability until a patch is applied. This includes embedded systems, IoT devices, container hosts, and servers that rely on SCTP for signaling or data transport.

Exploitability

The vulnerability is remotely exploitable over the network with no prior authentication required (CVSS AV:N/AC:L/PR:N). An attacker can trigger the crash by sending specially crafted SCTP packets that initiate an ADD_OUT_STREAMS negotiation and then trigger denial. The barrier to exploitation is low—standard SCTP protocol handling is sufficient. However, the attacker must target systems actually using SCTP; many general-purpose servers do not enable or expose SCTP by default. The bug is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Patch the Linux kernel with fixes that implement the full rollback procedure for denied ADD_OUT_STREAMS requests. Verify that your kernel version includes commits that unschedule scheduler state, call sctp_stream_outq_migrate() for cleanup, and reschedule remaining streams. Until patching is complete, disable SCTP at the network layer if it is not required, or restrict SCTP traffic using firewall rules to trusted peers only.

Patch guidance

Consult your Linux distribution's security advisories for kernel updates addressing CVE-2026-52929. Apply patches to all systems running SCTP workloads. If you maintain a custom kernel, backport the fix from upstream Linux kernel commits that fully resolve the stream rollback issue. Test patches in a staging environment before production deployment to ensure no regression in SCTP stream operations.

Detection guidance

Monitor system logs and kernel messages for SCTP-related crashes, null-pointer dereferences, or BUG/WARN messages in the sctp_stream or scheduler modules. Deploy intrusion detection rules that flag unusual SCTP ADD_OUT_STREAMS negotiation patterns or repeated denial-permission cycles. Network telemetry showing sudden SCTP connection resets or kernel panic events warrants immediate investigation. Vulnerable systems may exhibit intermittent reboots or loss of SCTP service availability.

Why prioritize this

Despite a CVSS score of 7.5 (HIGH), this vulnerability warrants immediate attention because it enables unauthenticated remote denial of service on any exposed SCTP service. The fix is straightforward and no exploits have been publicly disclosed yet, making this a window of opportunity to patch before the threat landscape shifts. Organizations running SCTP in production—especially in telecom, signaling, and cluster environments—should treat this as a critical priority.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects high severity due to a low attack complexity (L), no authentication requirement (N), and availability impact (A:H). The network attack vector (AV:N) and lack of confidentiality or integrity impact (C:N/I:N) moderate the score. The true risk depends on your exposure: organizations with no SCTP workloads face minimal risk, while those with customer-facing or internal SCTP services face significant availability and business continuity threats.

Frequently asked questions