Linux SCTP Stale COOKIE-ECHO UAF LPE (CVE-2026-52924)

CVE-2026-52924 is a use-after-free in the Linux kernel SCTP subsystem triggered during stale COOKIE-ECHO handling. The vulnerability occurs when the outqueue is not properly purged during stale cookie processing, leaving dangling references. Nebula Security developed weaponized exploits for both Arch Linux and Ubuntu targets. The exploit reclaims the freed SCTP association object via Unix socket control messages, constructs a fake object overlay with call_usermodehelper_exec primitives, and achieves root execution.

Root Cause

The SCTP stack fails to purge the outqueue when handling a stale COOKIE-ECHO response. This leaves freed association state reachable through existing socket references, creating a use-after-free condition.

Attack Vector

The exploit creates SCTP sockets and triggers the stale cookie path, then reclaims the freed memory using Unix domain socket control message spraying. A crafted overlay redirects control flow through call_usermodehelper to execute arbitrary commands as root.

Impact

Local privilege escalation to root.

• CVE-2026-52924
• NebuSec/CyberMeowfia - Arch variant
• NebuSec/CyberMeowfia - Ubuntu variant

Auto-ingested from NebuSec/CyberMeowfia on 2026-09-04. Two platform variants included (arch/ and ubuntu/).