CVE-2026-52929

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: stream: fully roll back denied add-stream state<br /> <br /> When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and<br /> then lowers outcnt. That leaves removed stream metadata behind, so a<br /> later re-add can reuse a stale ext and hit a null-pointer dereference in<br /> the scheduler get path.<br /> <br /> Fix the rollback by tearing down the removed stream state the same way<br /> other stream resizes do. Unschedule the current scheduler state, drop<br /> the removed stream ext state with sctp_stream_outq_migrate(), and then<br /> reschedule the remaining streams.<br /> <br /> This keeps scheduler-private RR/FC/PRIO lists consistent while fully<br /> rolling back denied outgoing stream additions.