CVE-2026-52929: PoC Exploit Published for Linux SCTP Privilege Escalation

TL;DR

A researcher published proof-of-concept exploit code for CVE-2026-52929, a Linux kernel SCTP flaw rated CVSS 7.5. The full vulnerability details are now public. A demo video shows the exploit escalating to root privileges on Ubuntu 26.04.

Why This Linux Kernel Flaw Matters

SCTP ships in most mainstream Linux distributions. As a result, the flaw touches a wide range of servers and workstations. The public release raises the stakes further. A working exploit code now sits in the open. Nebula Security posted the research to a public GitHub repository, and a demonstration video shows the abuse in action.

Today's exploit is for Ubuntu 26.04, an SCTP type confusion, CVE-2026-52929, classified as null-ptr-deref.

It was introduced in Oct 2017 and fixed upstream in Jun 2026.

Discovered and exploited by the NebuSec security pipeline.

Exploit source code: https://t.co/WC4CladQJg pic.twitter.com/Li23WxW4fA

— Nebula Security (@nebusecurity) August 20, 2026

How the Attack Works

The bug lives in the kernel’s SCTP stream handling. When a request to add outgoing streams is denied, the kernel does not fully roll back its state. Instead, it shrinks the queued chunks and lowers the stream count. However, it leaves stale stream metadata behind.

A later stream re-add can then reuse that stale entry. Consequently, the scheduler dereferences a null pointer and the kernel crashes. That crash yields a denial of service. The researcher’s demo goes further and shows escalation to root on a patched-behind Ubuntu build.

Affected Versions

The flaw dates back to code added in October 2017. Therefore many long-lived kernel branches are affected. Upstream developers fixed the issue in June 2026. The public proof-of-concept targets Ubuntu 26.04 running an unpatched kernel.

Patch and Mitigation Steps

Update the kernel first. Apply your distribution’s latest kernel package that carries the June 2026 fix. If you cannot patch right away, reduce exposure. Block the SCTP module where the protocol is not needed. Add a modprobe rule to stop it from loading, then reboot.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.