sctp: stream: fully roll back denied add-stream state
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
CVE-2026-52929
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-52929
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"lessThan": "0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85",
"versionType": "git"
},
{
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"lessThan": "a6724b7b812ac8793514a1d5938db5d9d29ae725",
"versionType": "git"
},
{
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"lessThan": "9662eb0401518f0b4681f10e7fbf688f504f24cf",
"versionType": "git"
},
{
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"lessThan": "7dd9a42b044aad2dbe037db1c1e2943582485b44",
"versionType": "git"
},
{
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"lessThan": "39dc2b0eb5371a669ebc9ec6072b9184eac95418",
"versionType": "git"
},
{
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"lessThan": "d5ea0b3e261fcb2cfff142675516165244cab1da",
"versionType": "git"
},
{
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"lessThan": "1c6773b8c081509dcd5cd2954f2b02c50c00f151",
"versionType": "git"
},
{
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"lessThan": "a5f8a90ac9f77c678a9781c0a464b635e0d63e49",
"versionType": "git"
}
],
"programFiles": [
"net/sctp/stream.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sctp/stream.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-52929
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40698 · Revision 1
- Added to Heist Feed
- Publisher date