CVE-2026-52924

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: purge outqueue on stale COOKIE-ECHO handling<br /> <br /> sctp_stream_update() is only invoked when the association is moved into<br /> COOKIE_WAIT during association setup/reconfiguration. In this path, the<br /> outbound stream scheduler state (stream-&gt;out_curr) is expected to be<br /> clean, since no user data should have been transmitted yet unless the<br /> state machine has already partially progressed.<br /> <br /> However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a<br /> Stale Cookie ERROR is received, the association is rolled back from<br /> COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already<br /> have been queued and even bundled with the COOKIE-ECHO chunk.<br /> <br /> During the rollback, sctp_stream_update() frees the old stream table<br /> and installs a new one, but it does not invalidate stream-&gt;out_curr.<br /> As a result, out_curr may still point to a freed sctp_stream_out<br /> entry from the previous stream state.<br /> <br /> Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on<br /> stream-&gt;out_curr-&gt;ext, which can lead to use-after-free once the old<br /> stream state has been released via sctp_stream_free().<br /> <br /> This results in crashes such as (reported by Yuqi):<br /> <br /> BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140<br /> Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312<br /> CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted<br /> 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)<br /> sctp_sched_fcfs_dequeue+0x13a/0x140<br /> sctp_outq_flush+0x1603/0x33e0<br /> sctp_do_sm+0x31c9/0x5d30<br /> sctp_assoc_bh_rcv+0x392/0x6f0<br /> sctp_inq_push+0x1db/0x270<br /> sctp_rcv+0x138d/0x3c10<br /> <br /> Fix this by fully purging the association outqueue when handling the<br /> Stale Cookie case. This ensures all pending transmit and retransmit<br /> state is dropped, and any scheduler cached pointers are invalidated,<br /> making it safe to rebuild stream state during COOKIE_WAIT restart.<br /> <br /> Updating only stream-&gt;out_curr would be insufficient, since queued<br /> and retransmittable data would still reference the old stream state and<br /> trigger later use-after-free in dequeue paths.