Look up another CVE · open CVE-2026-52929 in the interactive tracker
CVE-2026-52929
sctp: stream: fully roll back denied add-stream state
Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem net/sctp. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-52929 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4665-1 · 2026-07-03 · text | 6.1.176-1 | Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/sctp/stream.c
- What this is
- SCTP PROTOCOLMAINTAINERS section matched on net/sctp/ · linux-sctp@vger.kernel.org · Maintained
- Kernel module
- sctp
Check it on the machine
grep -w CONFIG_IP_SCTP /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w sctpPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_IP_SCTP
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-24 (4 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.53%, higher than 43.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/sctp
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.15 | 5.10.259 | 0cd2dc6dce8c |
| 4.15 | 5.15.210 | a6724b7b812a |
| 4.15 | 6.1.176 | 9662eb040151 |
| 4.15 | 6.6.143 | 7dd9a42b044a |
| 4.15 | 6.12.94 | 39dc2b0eb537 |
| 4.15 | 6.18.36 | d5ea0b3e261f |
| 4.15 | 7.0.13 | 1c6773b8c081 |
| 4.15 | 7.1 | a5f8a90ac9f7 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4671-1 | 2026-07-05 | bullseye 6.1.176-1~deb11u1 | tracker |
| DLA-4665-1 | 2026-07-03 | bookworm 6.1.176-1 | tracker |
| DLA-4664-1 | 2026-07-03 | bullseye 5.10.259-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerable code is reached while processing an SCTP RE-CONFIG response chunk received from a remote SCTP peer on an established association. A malicious peer can send a denied ADD_OUT_STREAMS response over the network once stream reconfiguration is negotiated.
- AC:LAttack complexity, low
- The packet/state sequence is protocol-controlled and reproducible: negotiate SCTP RE-CONFIG, trigger an ADD_OUT_STREAMS request, deny it, then cause later reuse of the stale stream state. Although RE-CONFIG must be enabled by the application, there is no race or condition outside the attacker's reasonable influence in a deployment using this feature.
- PR:NPrivileges required, none
- A remote SCTP peer does not need local kernel privileges or authenticated OS privileges to send the denial response. The path is gated by SCTP association state, verification tag, and matching outstanding request sequence, not by credentials.
- UI:NUser interaction, none
- No human user interaction is required once the SCTP service/association is operating with stream reconfiguration. The triggering input is network protocol traffic from the peer.
- S:UScope, unchanged
- The vulnerability affects kernel SCTP state within the same host security authority. It does not cross a VM, IOMMU, or other separate authorization boundary.
- C:NConfidentiality impact, none
- The investigated failure mode is stale SCTP stream scheduler metadata leading to a NULL pointer dereference in scheduler value retrieval. I did not find evidence of an attacker-controlled memory read or information disclosure primitive.
- I:NIntegrity impact, none
- The bug leaves scheduler-private stream state inconsistent but the demonstrated impact is a NULL dereference/crash, not controlled data modification or code execution. No arbitrary write primitive was evident from the rollback path.
- A:HAvailability impact, high
- The stale stream extension state can lead to a kernel NULL pointer dereference/oops in the SCTP scheduler path. A remotely reachable kernel crash is a high availability impact.