Linux Kernel SCTP Use-After-Free in Stale COOKIE-ECHO Rollback

#!/bin/bash
# CVE-2026-52924 Checker — Linux kernel SCTP stale COOKIE-ECHO UAF
# Run as root on the target host.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
VERSION=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse kernel version from: $KERNEL"
  exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

# Check if SCTP module is available (loadable)
SCTP_AVAIL="no"
if modprobe --dry-run sctp 2>/dev/null; then
  SCTP_AVAIL="yes"
elif lsmod | grep -q '^sctp '; then
  SCTP_AVAIL="loaded"
fi

echo "Kernel version: $KERNEL (parsed: $MAJOR.$MINOR.$PATCH)"
echo "SCTP module available: $SCTP_AVAIL"

if [ "$SCTP_AVAIL" = "no" ]; then
  echo "PATCHED (mitigated) — SCTP module is not loadable on this system."
  exit 0
fi

# version_gte: returns 0 if $1.$2.$3 >= $4.$5.$6
version_gte() {
  local a1=$1 a2=$2 a3=$3 b1=$4 b2=$5 b3=$6
  if [ "$a1" -gt "$b1" ] 2>/dev/null; then return 0; fi
  if [ "$a1" -lt "$b1" ] 2>/dev/null; then return 1; fi
  if [ "$a2" -gt "$b2" ] 2>/dev/null; then return 0; fi
  if [ "$a2" -lt "$b2" ] 2>/dev/null; then return 1; fi
  if [ "$a3" -ge "$b3" ] 2>/dev/null; then return 0; fi
  return 1
}

VULN="UNKNOWN"

case "$MAJOR.$MINOR" in
  4.14|4.13|4.12|4.11|4.10|4.9|4.8|4.7|4.6|4.5|4.4)
    # Kernels before 4.15 are NOT affected (bug introduced in 4.15)
    VULN="PATCHED"
    ;;
  4.15|4.16|4.17|4.18|4.19|4.20)
    # 4.15+ but before 5.x — affected, check RHEL backports
    # RHEL 8 uses 4.18.0-553.158.1+ as fix
    if echo "$KERNEL" | grep -q 'el8'; then
      RHEL_REL=$(echo "$KERNEL" | grep -oP '\d+-\K\d+\.\d+' | head -1)
      if [ -n "$RHEL_REL" ]; then
        RHEL_MAJOR=$(echo "$RHEL_REL" | cut -d. -f1)
        if [ "$RHEL_MAJOR" -ge 553 ] 2>/dev/null; then
          RHEL_MINOR=$(echo "$RHEL_REL" | cut -d. -f2)
          if [ "$RHEL_MAJOR" -gt 553 ] || [ "$RHEL_MINOR" -ge 158 ] 2>/dev/null; then
            VULN="PATCHED"
          else
            VULN="VULNERABLE"
          fi
        else
          VULN="VULNERABLE"
        fi
      else
        VULN="VULNERABLE"
      fi
    else
      VULN="VULNERABLE"
    fi
    ;;
  5.10)
    version_gte $MAJOR $MINOR $PATCH 5 10 259 && VULN="PATCHED" || VULN="VULNERABLE"
    ;;
  5.15)
    version_gte $MAJOR $MINOR $PATCH 5 15 210 && VULN="PATCHED" || VULN="VULNERABLE"
    ;;
  5.4|5.5|5.6|5.7|5.8|5.9|5.11|5.12|5.13|5.14|5.16|5.17|5.18|5.19)
    # 5.x branches between 4.15 and 5.10 or between stable branches — affected, EOL
    VULN="VULNERABLE"
    ;;
  6.1)
    version_gte $MAJOR $MINOR $PATCH 6 1 176 && VULN="PATCHED" || VULN="VULNERABLE"
    ;;
  6.6)
    version_gte $MAJOR $MINOR $PATCH 6 6 143 && VULN="PATCHED" || VULN="VULNERABLE"
    ;;
  6.12)
    version_gte $MAJOR $MINOR $PATCH 6 12 94 && VULN="PATCHED" || VULN="VULNERABLE"
    ;;
  6.18)
    version_gte $MAJOR $MINOR $PATCH 6 18 36 && VULN="PATCHED" || VULN="VULNERABLE"
    ;;
  7.0)
    version_gte $MAJOR $MINOR $PATCH 7 0 13 && VULN="PATCHED" || VULN="VULNERABLE"
    ;;
  7.1|7.2)
    version_gte $MAJOR $MINOR $PATCH 7 2 8 && VULN="PATCHED" || VULN="VULNERABLE"
    ;;
  *)
    if [ "$MAJOR" -ge 8 ] 2>/dev/null; then
      VULN="PATCHED"
    elif [ "$MAJOR" -lt 4 ] 2>/dev/null; then
      VULN="PATCHED"
    else
      VULN="UNKNOWN"
    fi
    ;;
esac

if [ "$VULN" = "VULNERABLE" ]; then
  echo "VULNERABLE — kernel $KERNEL is affected by CVE-2026-52924 and SCTP module is $SCTP_AVAIL."
  exit 1
elif [ "$VULN" = "PATCHED" ]; then
  echo "PATCHED — kernel $KERNEL is at or above the fixed version for this branch."
  exit 0
else
  echo "UNKNOWN — could not determine patch status for kernel $KERNEL. Manual review required."
  exit 2
fi