CVE-2026-52929: sctp: stream: fully roll back denied add-stream state
In the Linux kernel, the following vulnerability has been resolved:
sctp: stream: fully roll back denied add-stream state
When ADDOUTSTREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path.
Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctpstreamoutqmigrate(), and then reschedule the remaining streams.
This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52929?
CVE-2026-52929 has a risk rating of 37, indicating it is a moderate severity vulnerability.
What issues does CVE-2026-52929 address?
CVE-2026-52929 addresses the improper handling of stream metadata in the SCTP implementation of the Linux kernel.
How do I fix CVE-2026-52929?
To fix CVE-2026-52929, upgrade to the latest version of the Linux kernel that has patched this vulnerability.
Which software is affected by CVE-2026-52929?
CVE-2026-52929 affects the Linux kernel implementation of SCTP.
When was CVE-2026-52929 published?
CVE-2026-52929 was published on June 24, 2026.