Answer in brief
CVE-2026-52929 records a High severity (CVSS 7.5) vulnerability in sctp: stream: fully roll back denied add-stream state. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-52929 records a High severity (CVSS 7.5) vulnerability in sctp: stream: fully roll back denied add-stream state. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85 || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <a6724b7b812ac8793514a1d5938db5d9d29ae725 || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <9662eb0401518f0b4681f10e7fbf688f504f24cf || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <7dd9a42b044aad2dbe037db1c1e2943582485b44 || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <39dc2b0eb5371a669ebc9ec6072b9184eac95418 || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <d5ea0b3e261fcb2cfff142675516165244cab1da || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <1c6773b8c081509dcd5cd2954f2b02c50c00f151 || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <a5f8a90ac9f77c678a9781c0a464b635e0d63e49 | 0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85, a6724b7b812ac8793514a1d5938db5d9d29ae725, 9662eb0401518f0b4681f10e7fbf688f504f24cf, 7dd9a42b044aad2dbe037db1c1e2943582485b44, 39dc2b0eb5371a669ebc9ec6072b9184eac95418, d5ea0b3e261fcb2cfff142675516165244cab1da, 1c6773b8c081509dcd5cd2954f2b02c50c00f151, a5f8a90ac9f77c678a9781c0a464b635e0d63e49 |
| Linux/Linuxgeneric | 4.15 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
Quoted source text, attributed separately from HOL analysis.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85 || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <a6724b7b812ac8793514a1d5938db5d9d29ae725 || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <9662eb0401518f0b4681f10e7fbf688f504f24cf || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <7dd9a42b044aad2dbe037db1c1e2943582485b44 || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <39dc2b0eb5371a669ebc9ec6072b9184eac95418 || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <d5ea0b3e261fcb2cfff142675516165244cab1da || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <1c6773b8c081509dcd5cd2954f2b02c50c00f151 || >=637784ade221a3c8a7ecd0f583eddd95d6276b9a <a5f8a90ac9f77c678a9781c0a464b635e0d63e49 | 0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85, a6724b7b812ac8793514a1d5938db5d9d29ae725, 9662eb0401518f0b4681f10e7fbf688f504f24cf, 7dd9a42b044aad2dbe037db1c1e2943582485b44, 39dc2b0eb5371a669ebc9ec6072b9184eac95418, d5ea0b3e261fcb2cfff142675516165244cab1da, 1c6773b8c081509dcd5cd2954f2b02c50c00f151, a5f8a90ac9f77c678a9781c0a464b635e0d63e49 |
| Linux/Linuxgeneric | 4.15 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
Quoted source text, attributed separately from HOL analysis.