---
title: "CVE-2026-52929 — A failed SCTP stream reset could corrupt the scheduler queue"
description: "CVE-2026-52929: When an SCTP stream-reset request failed, Linux could remove output streams without fully removing their scheduling records. The scheduler was then left with entries that looked valid but pointed to an empty queue. Fixed upstream in June 2026."
url: https://nebusec.ai/buglist/CVE-2026-52929/
published: 2026-08-20T00:00:00.000Z
---

CVE-2026-52929 · High

# A failed SCTP stream reset could corrupt the scheduler queue

Linux kernel · SCTP · Published Aug 20, 2026

sctp_process_strreset_resp

* [CVSS 7.5 · CNA ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-52929)
* Fixed
* Out-of-bounds-write
* Namespace required

Affects · Linux v5.8-rc7 until the fix · Ubuntu 26.04 · Linux 7.0.0-28 demo target

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

## Summary

When an SCTP stream-reset request failed, Linux could remove output streams without fully removing their scheduling records. The scheduler was then left with entries that looked valid but pointed to an empty queue.

The public demonstration targeted Ubuntu 26.04 with Linux 7.0.0-28. The underlying bug had existed since October 2017 and was fixed upstream in June 2026.

## Why it mattered

In a namespace-enabled environment, a local attacker could create SCTP traffic and drive the failed reset path. A later dequeue could interpret a list head as a packet, turning the stale scheduler state into kernel memory corruption.

The affected code has been fixed. The risk described here applies to unpatched kernels in the affected line, not automatically to every system using the named distribution today.

## What went wrong

`sctp_process_strreset_resp()` called `sctp_stream_shrink_out()` directly. Unlike the normal stream update paths, this route did not complete the scheduler-specific dequeue cleanup, so round-robin and other schedulers could retain stale stream nodes.

## Exploit

Because the issue and its fixes are public, NebuSec’s validation code is included here for reproducibility. The preview starts at the program entry point and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; build files, headers, helpers, and any additional sources remain in the linked CyberMeowfia directory.

Public exploit · patched target

CyberMeowfia snapshot4c1f0aa

[Browse all files](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52929-Ubuntu-7.0.0-28)

SCTP trigger and exploit · 770 lines · [Open at main() ↗](https://github.com/NebuSec/CyberMeowfia/blob/4c1f0aaaf1b981e74c47f24d88ebdf6ad51c9586/security-research/Linux-CVE-2026-52929-Ubuntu-7.0.0-28/confuse.c#L718)

```c
int main(void)
{
  struct sockaddr_in a = { .sin_family = AF_INET,
    .sin_addr.s_addr = htonl(INADDR_LOOPBACK) };
  struct sctp_initmsg init = { .sinit_num_ostreams = 1,
    .sinit_max_instreams = 128 };
  socklen_t alen = sizeof(a);
  int lfd, peers[NREADERS], sz = 4 << 20;
  int st, child_reaped = 0;
  pid_t pid;
  pthread_t lockers[NREADERS], server_rxs[NREADERS];

  setvbuf(stdout, NULL, _IONBF, 0);
  printf("uid=%u gid=%u\n", getuid(), getgid());
  lfd = socket(AF_INET, SOCK_STREAM, IPPROTO_SCTP);
```

The selected file is the execution entry point. Build files, headers, leak helpers, and supporting sources remain in the linked CyberMeowfia directory.

## Patch

**Fixed upstream in June 2026.** The correction ensures stream scheduler metadata is unscheduled before output streams are removed. Apply the kernel supplied by the distribution; disabling SCTP or restricting unprivileged namespaces can reduce exposure on systems that cannot yet update.

The safest check is the distribution’s own kernel changelog for `CVE-2026-52929`; version numbers alone can be misleading because vendors routinely backport security fixes without changing to the newest upstream kernel.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)