[SRU][Q/N/J][PATCH 0/3] CVE-2026-52924

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-52924

[ Impact ]

When an SCTP association receives a Stale Cookie ERROR, it is rolled back from
COOKIE_ECHOED to COOKIE_WAIT. During this rollback, sctp_stream_update() frees
the old stream table and installs a new one but does not invalidate
stream->out_curr, which may still point to a freed sctp_stream_out entry. SCTP
scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext,
leading to a use-after-free once the old stream state has been released. A
local attacker could exploit this to crash the system or potentially execute
arbitrary code.

[ Fix ]

questing: clean cherry-pick
noble: clean cherry-pick
jammy: clean cherry-pick
focal: clean cherry-pick
bionic: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A defect in this fix could affect the SCTP protocol subsystem, particularly
association setup and stale COOKIE-ECHO handling, potentially causing dropped
transmit or retransmit state or connection setup failures.