Description
In the Linux kernel, the following vulnerability has been resolved:
sctp: purge outqueue on stale COOKIE-ECHO handling
sctp_stream_update() is only invoked when the association is moved into
COOKIE_WAIT during association setup/reconfiguration. In this path, the
outbound stream scheduler state (stream->out_curr) is expected to be
clean, since no user data should have been transmitted yet unless the
state machine has already partially progressed.
However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a
Stale Cookie ERROR is received, the association is rolled back from
COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already
have been queued and even bundled with the COOKIE-ECHO chunk.
During the rollback, sctp_stream_update() frees the old stream table
and installs a new one, but it does not invalidate stream->out_curr.
As a result, out_curr may still point to a freed sctp_stream_out
entry from the previous stream state.
Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on
stream->out_curr->ext, which can lead to use-after-free once the old
stream state has been released via sctp_stream_free().
This results in crashes such as (reported by Yuqi):
BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140
Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312
CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted
7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)
sctp_sched_fcfs_dequeue+0x13a/0x140
sctp_outq_flush+0x1603/0x33e0
sctp_do_sm+0x31c9/0x5d30
sctp_assoc_bh_rcv+0x392/0x6f0
sctp_inq_push+0x1db/0x270
sctp_rcv+0x138d/0x3c10
Fix this by fully purging the association outqueue when handling the
Stale Cookie case. This ensures all pending transmit and retransmit
state is dropped, and any scheduler cached pointers are invalidated,
making it safe to rebuild stream state during COOKIE_WAIT restart.
Updating only stream->out_curr would be insufficient, since queued
and retransmittable data would still reference the old stream state and
trigger later use-after-free in dequeue paths.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 4.15 | 5.10.259 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.0.13-1 | — |
| Debian 13 | linux | 6.12.94-1 | — |
| Debian 12 | linux | 6.1.176-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | 6.8.0-1028.33 | — |
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1097.99 | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-29.29 | USN-8629-1 |
| Ubuntu 26.04 LTS | linux-aws +3 | 7.0.0-1010.10 | USN-8660-1, USN-8637-1, USN-8629-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1005.6 | USN-8660-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1011.11 | USN-8629-1 |
| Ubuntu 26.04 LTS | linux-nvidia-bos | 7.0.0-2016.16 | USN-8664-1 |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1009.9 | USN-8629-1 |
| Ubuntu 26.04 LTS | linux-raspi +1 | 7.0.0-1016.16 | USN-8663-1, USN-8629-1 |
| Ubuntu 26.04 LTS | linux-riscv +1 | 7.0.0-29.29.1 | USN-8629-1 |
| Ubuntu 25.10 | linux +8 | No fix yet | — |
| Ubuntu 24.04 LTS | linux | 6.8.0-137.137 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1062.65 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-aws-7.0 | 7.0.0-1010.10~24.04.1 | USN-8629-2 |
| Ubuntu 24.04 LTS | linux-azure | 6.8.0-1064.72 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-azure-6.17 | 6.17.0-1022.22 | USN-8636-1 |
| Ubuntu 24.04 LTS | linux-azure-7.0 | 7.0.0-1014.14~24.04.1 | USN-8728-2 |
| Ubuntu 24.04 LTS | linux-azure-fde | 6.8.0-1063.70 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1013.13~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-gcp | 6.8.0-1065.73 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-gcp-6.17 | 6.17.0-1022.25 | USN-8636-1 |
| Ubuntu 24.04 LTS | linux-gcp-7.0 +1 | 7.0.0-1011.11~24.04.1 | USN-8728-3, USN-8728-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1060.68 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1047.51 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-hwe-6.17 | 6.17.0-42.42 | USN-8636-1 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-29.29~24.04.2 | USN-8629-3 |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1062.63 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-lowlatency | 6.8.0-137.137.1 | USN-8630-2 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1060.63 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-nvidia-6.17 | 6.17.0-1031.31 | USN-8669-1 |
| Ubuntu 24.04 LTS | linux-nvidia-7.0 | 7.0.0-1016.16~24.04.1 | USN-8663-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1060.63.1 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1031.32 | USN-8630-2 |
| Ubuntu 24.04 LTS | linux-oem-6.17 | 6.17.0-1032.32 | USN-8636-1 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1059.62 | USN-8630-2 |
| Ubuntu 24.04 LTS | linux-oracle-6.17 | 6.17.0-1020.20 | USN-8636-2 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1062.66 | USN-8630-5 |
| Ubuntu 24.04 LTS | linux-riscv +22 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-30.30.1~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-vmware | 6.8.0-1008.8 | — |
| Ubuntu 24.04 LTS | linux-xilinx | 6.8.0-1034.35 | USN-8630-1 |
Show 20 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | linux | 5.15.0-187.197 | USN-8631-1 |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1113.120 | USN-8631-1 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1062.65~22.04.2 | USN-8630-4 |
| Ubuntu 22.04 LTS | linux-azure +1 | 5.15.0-1118.127 | USN-8631-1 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1064.72~22.04.1 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.8 | 6.8.0-1063.70~22.04.1 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1114.124 | USN-8661-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1065.73~22.04.1 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-gke +1 | 5.15.0-1110.116 | USN-8661-3, USN-8631-2 |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1096.104 | USN-8631-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-138.138~22.04.1 | USN-8656-1 |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1107.111 | USN-8631-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1062.63~22.04.1 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1108.114 | USN-8631-1 |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1105.110 | USN-8631-1 |
| Ubuntu 22.04 LTS | linux-lowlatency | 5.15.0-190.200 | USN-8661-2 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.8 | 6.8.0-137.137.1~22.04.1 | USN-8630-2 |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1108.109 | USN-8631-1 |
| Ubuntu 22.04 LTS | linux-nvidia-6.8 | 6.8.0-1060.63~22.04.1 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1065.67 | USN-8631-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1054.54 | USN-8631-3 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1059.62~22.04.1 | USN-8630-3 |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1108.111 | USN-8661-5 |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv-6.8 | 6.8.0-137.137~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1076.80 | USN-8631-1 |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2051.53 | USN-8630-5 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1057.58 | USN-8630-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.17 | 6.17.0-1019.22 | USN-8636-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1105.107 | USN-8631-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1112.121 | USN-8631-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1057.58~22.04.1 | USN-8630-1 |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-aws-fips | 6.8.0-1062.65+fips1 | USN-8630-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-azure-fips | 6.8.0-1064.72+fips1 | USN-8630-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-137.137+fips1 | USN-8630-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-gcp-fips | 6.8.0-1065.73+fips1 | USN-8630-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-aws-fips | 5.15.0-1113.120+fips1 | USN-8631-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-azure-fips | 5.15.0-1118.127+fips1 | USN-8631-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips | 5.15.0-190.200+fips1 | USN-8661-3 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-gcp-fips | 5.15.0-1114.124+fips1 | USN-8661-1 |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1163.174+fips1 | USN-8715-2 |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1167.173+fips1 | USN-8666-2 |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1136.146 | USN-8666-1 |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1165.174+fips1 | USN-8666-3 |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2133.139 | USN-8633-1 |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2113.119 | USN-8633-1 |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1150.162 | USN-8633-1 |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-gcp-fips | 4.15.0-2096.102 | USN-8633-1 |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 26.04 LTS | linux | 7.0.0-30.30 | LSN-0122-1 |
| Ubuntu Pro 26.04 LTS | linux-aws | 7.0.0-1011.11 | LSN-0122-1 |
| Ubuntu Pro 26.04 LTS | linux-azure | 7.0.0-1012.12 | LSN-0122-1 |
| Ubuntu Pro 26.04 LTS | linux-gcp | 7.0.0-1010.10 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux | 6.8.0-142.142 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-aws | 6.8.0-1065.68 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-azure | 6.8.0-1068.76 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-gcp | 6.8.0-1069.77 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-gke | 6.8.0-1064.72 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-ibm | 6.8.0-1065.66 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-oracle | 6.8.0-1062.65 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux | 5.15.0-202.212 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-aws | 5.15.0-1119.126 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-aws-6.8 | 6.8.0-1065.68~22.04.1 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-azure | 5.15.0-1125.134 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-gcp | 5.15.0-1120.130 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-gcp-6.8 | 6.8.0-1069.77~22.04.1 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-gke | 5.15.0-1115.121 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-hwe-6.8 | 6.8.0-149.149~22.04.1 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-ibm | 5.15.0-1113.117 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-ibm-6.8 | 6.8.0-1066.67~22.04.1 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-lowlatency | 5.15.0-197.207 | LSN-0122-1 |
| Ubuntu Pro 20.04 LTS | linux | 5.4.0-234.254 | USN-8666-1, LSN-0122-1 |
| Ubuntu Pro 20.04 LTS | linux-aws | 5.4.0-1162.173 | USN-8666-1 |
| Ubuntu Pro 20.04 LTS | linux-aws-5.15 | 5.15.0-1114.121~20.04.1 | USN-8661-4 |
| Ubuntu Pro 20.04 LTS | linux-azure | 5.4.0-1167.173 | USN-8666-1 |
| Ubuntu Pro 20.04 LTS | linux-azure-5.15 | 5.15.0-1119.128~20.04.1 | USN-8661-1 |
| Ubuntu Pro 20.04 LTS | linux-azure-fde-5.15 | 5.15.0-1118.127~20.04.1 | USN-8631-4 |
| Ubuntu Pro 20.04 LTS | linux-bluefield | 5.4.0-1121.128 | USN-8666-1 |
| Ubuntu Pro 20.04 LTS | linux-gcp | 5.4.0-1165.174 | USN-8666-1 |
| Ubuntu Pro 20.04 LTS | linux-gcp-5.15 | 5.15.0-1114.124~20.04.1 | USN-8661-4 |
| Ubuntu Pro 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-190.200~20.04.1 | USN-8661-1 |
| Ubuntu Pro 20.04 LTS | linux-ibm | 5.4.0-1108.113 | USN-8666-1 |
| Ubuntu Pro 20.04 LTS | linux-ibm-5.15 +1 | 5.15.0-1107.111~20.04.1 | USN-8631-1 |
| Ubuntu Pro 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1108.114~20.04.1 | USN-8631-1 |
| Ubuntu Pro 20.04 LTS | linux-iot | 5.4.0-1066.69 | USN-8666-1 |
| Ubuntu Pro 20.04 LTS | linux-kvm | 5.4.0-1149.158 | USN-8667-1 |
| Ubuntu Pro 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1065.67~20.04.1 | USN-8631-1 |
| Ubuntu Pro 20.04 LTS | linux-oracle | 5.4.0-1160.170 | USN-8666-1 |
| Ubuntu Pro 20.04 LTS | linux-oracle-5.15 | 5.15.0-1110.116~20.04.1 | USN-8631-1 |
| Ubuntu Pro 20.04 LTS | linux-raspi | 5.4.0-1145.158 | USN-8666-1 |
| Ubuntu Pro 20.04 LTS | linux-xilinx-zynqmp | 5.4.0-1080.84 | USN-8666-1 |
| Ubuntu Pro 18.04 LTS | linux | 4.15.0-254.266 | USN-8633-1, LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-aws | 4.15.0-1195.208 | USN-8633-1, LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-aws-5.4 | 5.4.0-1162.173~18.04.1 | USN-8666-1 |
| Ubuntu Pro 18.04 LTS | linux-azure-4.15 | 4.15.0-1205.220 | USN-8633-1, LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-azure-5.4 | 5.4.0-1167.173~18.04.1 | USN-8666-2 |
| Ubuntu Pro 18.04 LTS | linux-gcp-4.15 | 4.15.0-1188.205 | USN-8633-1, LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-gcp-5.4 | 5.4.0-1165.174~18.04.1 | USN-8666-1 |
| Ubuntu Pro 18.04 LTS | linux-hwe-5.4 | 5.4.0-234.254~18.04.1 | USN-8666-1, LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-ibm-5.4 | 5.4.0-1108.113~18.04.1 | USN-8666-1 |
| Ubuntu Pro 18.04 LTS | linux-kvm | 4.15.0-1177.182 | USN-8633-1 |
| Ubuntu Pro 18.04 LTS | linux-oracle | 4.15.0-1158.169 | USN-8645-1, LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-oracle-5.4 | 5.4.0-1161.171~18.04.1 | USN-8715-1 |
| Ubuntu Pro 18.04 LTS | linux-raspi-5.4 | 5.4.0-1145.158~18.04.1 | USN-8666-1 |
| Ubuntu Pro 16.04 LTS | linux | 4.4.0-291.325 | LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-aws | 4.4.0-1200.215 | LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-aws-hwe | 4.15.0-1195.208~16.04.1 | USN-8633-2, LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-azure | 4.15.0-1205.220~16.04.1 | USN-8633-2, LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-gcp | 4.15.0-1188.205~16.04.1 | USN-8633-2, LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-hwe | 4.15.0-254.266~16.04.1 | USN-8633-2, LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-oracle | 4.15.0-1158.169~16.04.1 | USN-8645-1 |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1205.220~14.04.1 | USN-8635-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rv +76 | 6.12.0-211.55.1.el10_2 | RHSA-2026:67471 |
| RHEL 9 | rv +75 | 5.14.0-687.42.1.el9_8 | RHSA-2026:59723 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.158.1.rt7.499.el8_10 | RHSA-2026:59737 |
| RHEL 8 | perf +26 | 4.18.0-553.158.1.el8_10 | RHSA-2026:59821 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | rv +77 | 6.12.0-55.109.1.el10_0 | RHSA-2026:77634 |
| RHEL 9.6 EUS | rv +77 | 5.14.0-570.146.1.el9_6 | RHSA-2026:74174 |
| RHEL 9.4 E4S | bpftool | 7.3.0-427.153.1.el9_4 | RHSA-2026:73645 |
| RHEL 9.4 E4S | rv +62 | 5.14.0-427.153.1.el9_4 | RHSA-2026:73645 |
| RHEL 9.2 E4S | bpftool | 7.0.0-284.195.1.el9_2 | RHSA-2026:77215 |
| RHEL 9.2 E4S | kernel-rt +14 | 5.14.0-284.195.1.rt14.480.el9_2 | RHSA-2026:77214 |
| RHEL 9.2 E4S | perf +47 | 5.14.0-284.195.1.el9_2 | RHSA-2026:77215 |
| RHEL 8.8 TUS | perf +17 | 4.18.0-477.172.1.el8_8 | RHSA-2026:77301 |
| RHEL 8.8 E4S | perf +18 | 4.18.0-477.172.1.el8_8 | RHSA-2026:77301 |
| RHEL 8.6 EUS Long Life | perf +25 | 4.18.0-372.220.1.el8_6 | RHSA-2026:77216 |
| RHEL 8.6 AUS | perf +17 | 4.18.0-372.220.1.el8_6 | RHSA-2026:77216 |
| RHEL 8.4 EUS Long Life | perf +25 | 4.18.0-305.211.1.el8_4 | RHSA-2026:77217 |
| RHEL 8.4 AUS | perf +17 | 4.18.0-305.211.1.el8_4 | RHSA-2026:77217 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rv +74 | 6.12.0-211.55.1.el10_2 | ALSA-2026:67471 |
| AlmaLinux 9 | rv +73 | 5.14.0-687.42.1.el9_8 | ALSA-2026:59723 |
| AlmaLinux 8 | kernel-rt +9 | 4.18.0-553.158.1.rt7.499.el8_10 | ALSA-2026:59737 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.158.1.el8_10 | ALSA-2026:59821 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | kernel | 6.12.0-211.55.1.el10_2 | RLSA-2026:67471 |
| Rocky Linux 9 | kernel | 5.14.0-687.42.1.el9_8 | RLSA-2026:59723 |
| Rocky Linux 8 | kernel | 4.18.0-553.158.1.el8_10 | RLSA-2026:59821 |
| Rocky Linux 8 | kernel-rt | 4.18.0-553.158.1.rt7.499.el8_10 | RLSA-2026:59737 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +4 | 6.4.0-150700.53.73.2 | SUSE-SU-2026:3166-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.73.2.150700.17.41.4 | SUSE-SU-2026:3166-1 |
| SLES 15 SP7 | kernel-docs +2 | 6.4.0-150700.53.73.1 | SUSE-SU-2026:3166-1 |
| SLES 15 SP6 | kernel-64kb +6 | 6.4.0-150600.23.125.1 | SUSE-SU-2026:3156-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.125.1.150600.12.58.3 | SUSE-SU-2026:3156-1 |
| SLES 15 SP5 | kernel-64kb +6 | 5.14.21-150500.55.177.1 | SUSE-SU-2026:3089-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.177.1.150500.6.83.2 | SUSE-SU-2026:3089-1 |
| SLES 15 SP4 | kernel-64kb +6 | 5.14.21-150400.24.228.1 | SUSE-SU-2026:3044-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.228.1.150400.24.116.1 | SUSE-SU-2026:3044-1 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.36.1 | SUSE-SU-2026:22835-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22835-1 |
| SLES for SAP 15 SP6 | kernel-default-base | 6.4.0-150600.23.125.1.150600.12.58.3 | SUSE-SU-2026:3156-1 |
| SLES for SAP 15 SP6 | kernel-docs +4 | 6.4.0-150600.23.125.1 | SUSE-SU-2026:3156-1 |
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.177.1.150500.6.83.2 | SUSE-SU-2026:3089-1 |
| SLES for SAP 15 SP5 | kernel-docs +4 | 5.14.21-150500.55.177.1 | SUSE-SU-2026:3089-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.228.1.150400.24.116.1 | SUSE-SU-2026:3044-1 |
| SLES for SAP 15 SP4 | kernel-docs +4 | 5.14.21-150400.24.228.1 | SUSE-SU-2026:3044-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.36.1 | SUSE-SU-2026:22835-1, SUSE-SU-2026:22812-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22835-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22769-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.36.1 | SUSE-SU-2026:22769-1, SUSE-SU-2026:22742-1 |
| SLE Micro 6.1 | kernel-rt +2 | 6.4.0-50.1 | SUSE-SU-2026:22904-1, SUSE-SU-2026:22903-1 |
| SLE Micro 6.1 | kernel-source +1 | 6.4.0-50.2 | SUSE-SU-2026:22904-1, SUSE-SU-2026:22903-1 |
| SLE Micro 6.0 | kernel-rt +2 | 6.4.0-50.1 | SUSE-SU-2026:22810-1, SUSE-SU-2026:22809-1 |
| SLE Micro 6.0 | kernel-source +1 | 6.4.0-50.2 | SUSE-SU-2026:22810-1, SUSE-SU-2026:22809-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.177.1.150500.6.83.2 | SUSE-SU-2026:3089-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.151.1 | SUSE-SU-2026:2840-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.177.1 | SUSE-SU-2026:3089-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.228.1.150400.24.116.1 | SUSE-SU-2026:3044-1 |
| SLE Micro 5.4 | kernel-rt +1 | 5.14.21-150400.15.176.1 | SUSE-SU-2026:2841-1 |
| SLE Micro 5.4 | kernel-source +1 | 5.14.21-150400.24.228.1 | SUSE-SU-2026:3044-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.228.1.150400.24.116.1 | SUSE-SU-2026:3044-1 |
| SLE Micro 5.3 | kernel-rt +1 | 5.14.21-150400.15.176.1 | SUSE-SU-2026:2841-1 |
| SLE Micro 5.3 | kernel-source +1 | 5.14.21-150400.24.228.1 | SUSE-SU-2026:3044-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.73.2 | SUSE-SU-2026:3166-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_18 | 1-150700.1.5.1 | SUSE-SU-2026:3130-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_19 | 1-150700.15.3.4 | SUSE-SU-2026:3166-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.125.1 | SUSE-SU-2026:3156-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_29 | 1-150600.13.7.1 | SUSE-SU-2026:3156-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.177.1 | SUSE-SU-2026:3089-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_43 | 1-150500.11.5.1 | SUSE-SU-2026:3089-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.228.1 | SUSE-SU-2026:3044-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_57 | 1-150400.9.3.1 | SUSE-SU-2026:3044-1 |
| SLE HPC 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.177.1 | SUSE-SU-2026:3089-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.177.1.150500.6.83.2 | SUSE-SU-2026:3089-1 |
| SLE HPC 15 SP4 | kernel-64kb +5 | 5.14.21-150400.24.228.1 | SUSE-SU-2026:3044-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.228.1.150400.24.116.1 | SUSE-SU-2026:3044-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +2 | 6.4.0-150700.7.67.1 | SUSE-SU-2026:3130-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | openSUSE-SU-2026:21388-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.36.1 | openSUSE-SU-2026:21388-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.36-69.134 +2 | 1:1.0-0.amzn2023 | ALAS2023-2026-1968, ALAS2023-2026-1925, ALAS2023-2026-1924 |
| Amazon Linux 2023 | perf +11 | 1:6.1.176-220.358.amzn2023 | ALAS2023-2026-1924 |
| Amazon Linux 2023 | perf6.12 +11 | 1:6.12.94-123.174.amzn2023 | ALAS2023-2026-1968 |
| Amazon Linux 2023 | perf6.18 +12 | 1:6.18.36-69.134.amzn2023 | ALAS2023-2026-1925 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.143.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-206.104.3.3.el10uek | ELSA-2026-500248 |
| Oracle Linux 9 | rv +28 | 5.14.0-687.42.1.el9_8 | ELSA-2026-59723 |
| Oracle Linux 8 | perf +19 | 4.18.0-553.158.1.el8_10 | ELSA-2026-59821 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
Eliot-code/CVE-2026-52924 ★ 0 · Sep 7, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 50
- USN-8663-1 linux-nvidia, linux-nvidia-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8728-1 linux-gcp-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8728-3 linux-oracle-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8728-2 linux-azure-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8664-1 linux-nvidia-bos vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- RHSA-2026:77216 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:77217 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:77301 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:59821 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:59723 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:59737 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:67471 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:74174 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- LSN-0122-1 Kernel Live Patch Security Notice Ubuntu Security Notices (USN) · Nov 12, 2026
- WID-SEC-2026-2056 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8669-1 linux-nvidia-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8636-2 linux-oracle-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8636-1 linux-azure-6.17, linux-gcp-6.17, linux-hwe-6.17, linux-oem-6.17, linux-realtime-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8635-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- WID-SEC-2026-3595 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:59723 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:67471 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:59737 Important: kernel-rt security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:59821 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:77215 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:77214 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:73645 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:77634 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- USN-8631-1 linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-fde, linux-azure-fips, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle-5.15, linux-realtime, linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- USN-8630-1 linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-6.8, linux-azure-fde, linux-azure-fde-6.8, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-6.8, linux-gcp-fips, linux-gke, linux-gkeop, linux-ibm, linux-ibm-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-realtime, linux-realtime-6.8, linux-xilinx vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- USN-8661-5 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Sep 22, 2026
- USN-8715-2 linux-aws-fips vulnerabilities Ubuntu Security Notices (USN) · Sep 18, 2026
- RLSA-2026:67471 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 16, 2026
- USN-8666-1 linux, linux-aws, linux-aws-5.4, linux-azure, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-oracle, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8633-1 linux, linux-aws, linux-aws-fips, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp-4.15, linux-gcp-fips, linux-kvm vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8661-1 linux-azure-5.15, linux-gcp, linux-gcp-fips, linux-hwe-5.15, linux-lowlatency-hwe-5.15 vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8715-1 linux-oracle-5.4 vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8633-2 linux-aws-hwe, linux-azure, linux-gcp, linux-hwe vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8667-1 linux-kvm vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8666-2 linux-azure-5.4, linux-azure-fips vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8666-3 linux-gcp-fips vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8661-4 linux-aws-5.15, linux-gcp-5.15 vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8645-1 linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8630-3 linux-oracle-6.8 vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8630-4 linux-aws-6.8 vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8630-5 linux-raspi, linux-raspi-realtime vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8631-2 linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8637-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8630-2 linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia-tegra, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8661-2 linux-lowlatency vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
References
- https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285
- https://git.kernel.org/stable/c/f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8
- https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8
- https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc
- https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0
- https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5
- https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f
- https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb