← Back to CVE Explorer

CVE-2026-52929

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.

Severity
HIGH
CVSS score
7.5 (v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-06-24 08:16:23.040000
Last modified
2026-10-19 20:18:47.727000
View original CVE JSON 
{
  "id": "CVE-2026-52929",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-06-24T08:16:23.040",
  "lastModified": "2026-10-19T20:18:47.727",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: stream: fully roll back denied add-stream state\n\nWhen ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and\nthen lowers outcnt. That leaves removed stream metadata behind, so a\nlater re-add can reuse a stale ext and hit a null-pointer dereference in\nthe scheduler get path.\n\nFix the rollback by tearing down the removed stream state the same way\nother stream resizes do. Unschedule the current scheduler state, drop\nthe removed stream ext state with sctp_stream_outq_migrate(), and then\nreschedule the remaining streams.\n\nThis keeps scheduler-private RR/FC/PRIO lists consistent while fully\nrolling back denied outgoing stream additions."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "net/sctp/stream.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
              "lessThan": "0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
              "lessThan": "a6724b7b812ac8793514a1d5938db5d9d29ae725",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
              "lessThan": "9662eb0401518f0b4681f10e7fbf688f504f24cf",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
              "lessThan": "7dd9a42b044aad2dbe037db1c1e2943582485b44",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
              "lessThan": "39dc2b0eb5371a669ebc9ec6072b9184eac95418",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
              "lessThan": "d5ea0b3e261fcb2cfff142675516165244cab1da",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
              "lessThan": "1c6773b8c081509dcd5cd2954f2b02c50c00f151",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
              "lessThan": "a5f8a90ac9f77c678a9781c0a464b635e0d63e49",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "net/sctp/stream.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4.15",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "4.15",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.259",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.210",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.176",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.143",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.94",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.36",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.0.13",
              "lessThanOrEqual": "7.0.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "lessThan": "*",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-16T15:22:54.348092Z",
          "id": "CVE-2026-52929",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.15",
              "versionEndExcluding": "5.10.259",
              "matchCriteriaId": "E2E6634B-DED7-40B3-A18B-2140A791419F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.11",
              "versionEndExcluding": "5.15.210",
              "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.16",
              "versionEndExcluding": "6.1.176",
              "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2",
              "versionEndExcluding": "6.6.143",
              "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.7",
              "versionEndExcluding": "6.12.94",
              "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13",
              "versionEndExcluding": "6.18.36",
              "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.19",
              "versionEndExcluding": "7.0.13",
              "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "1039E95A-8CC3-4C88-8FF9-5C08EEB861C9"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/1c6773b8c081509dcd5cd2954f2b02c50c00f151",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/39dc2b0eb5371a669ebc9ec6072b9184eac95418",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/7dd9a42b044aad2dbe037db1c1e2943582485b44",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/9662eb0401518f0b4681f10e7fbf688f504f24cf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/a5f8a90ac9f77c678a9781c0a464b635e0d63e49",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/a6724b7b812ac8793514a1d5938db5d9d29ae725",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/d5ea0b3e261fcb2cfff142675516165244cab1da",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html",
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    }
  ]
}