---
title: "CVE-2026-52924 — An SCTP stream update could leave the scheduler pointing at freed memory"
description: "CVE-2026-52924: When SCTP replaced its output-stream table, it freed the old table but kept a scheduler cursor pointing into it. The next dequeue could follow that stale cursor and manipulate list pointers inside memory that had already been reused. Fixed upstream in June 2026."
url: https://nebusec.ai/buglist/CVE-2026-52924/
published: 2026-09-03T00:00:00.000Z
---

CVE-2026-52924 · Critical

# An SCTP stream update could leave the scheduler pointing at freed memory

Linux kernel · SCTP · Published Sep 03, 2026

sctp_stream_update

* [CVSS 9.8 · CNA ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-52924)
* Fixed
* Use-after-free
* Namespace required

Affects · Linux v4.15-rc1 until the fix · Ubuntu 26.04 · Linux 7.0.0-28 demo target

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

## Summary

When SCTP replaced its output-stream table, it freed the old table but kept a scheduler cursor pointing into it. The next dequeue could follow that stale cursor and manipulate list pointers inside memory that had already been reused.

The bug was introduced in October 2017 and fixed upstream in June 2026. The public exploit targeted Ubuntu 26.04 with Linux 7.0.0-28.

## Why it mattered

A local attacker with access to SCTP inside a network namespace could arrange a stream update followed by scheduler activity. The stale cursor provided a practical kernel memory-corruption path and local privilege escalation.

The affected code has been fixed. The risk described here applies to unpatched kernels in the affected line, not automatically to every system using the named distribution today.

## What went wrong

`sctp_stream_update()` replaced `stream->out` and freed its old genradix, but did not reset `stream->out_curr`. FCFS, round-robin, priority, and fair-capacity dequeue paths could later dereference the freed stream extension.

## Exploit

Because the issue and its fixes are public, NebuSec’s validation code is included here for reproducibility. The preview starts at the program entry point and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; build files, headers, helpers, and any additional sources remain in the linked CyberMeowfia directory.

Public exploit · patched target

CyberMeowfia snapshot4c1f0aa

[Browse all files](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28)

Exploit entry point · 301 lines · [Open at main() ↗](https://github.com/NebuSec/CyberMeowfia/blob/4c1f0aaaf1b981e74c47f24d88ebdf6ad51c9586/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/exploit.c#L241)

```c
int main(int argc, char **argv)
{
  struct page_ring stage2;
  struct sctp_trigger trigger;
  uint64_t search_anchor, physmap, kernel_base, known_page;
  uint64_t fake_ext;
  struct utsname uts;

  if (argc == 3 && !strcmp(argv[1], "--helper"))
    return show_flag(argv[2]);
  if (argc > 2 || (argc == 2 && strcmp(argv[1], "--vuln-trigger"))) {
    fprintf(stderr, "usage: %s [--vuln-trigger]\n", argv[0]);
    return 2;
  }
  if (argc == 2)
```

The selected file is the execution entry point. Build files, headers, leak helpers, and supporting sources remain in the linked CyberMeowfia directory.

## Patch

**Fixed upstream in June 2026.** The fix clears or reestablishes scheduler state when the stream table is replaced. Install the Ubuntu kernel update containing the June 2026 upstream fix; disabling SCTP is a temporary option for systems that cannot update.

The safest check is the distribution’s own kernel changelog for `CVE-2026-52924`; version numbers alone can be misleading because vendors routinely backport security fixes without changing to the newest upstream kernel.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)