CVE-2026-53246
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk38th percentile — higher than 38% of all known CVEs
Summary
In the Linux kernel SCTP stack, the cached INIT chunk length in COOKIE_ECHO processing was not validated, potentially leading to out-of-bounds reads and memory corruption.
Risk Assessment
An attacker could send a crafted COOKIE_ECHO packet with an inflated INIT chunk length, potentially causing data leaks or system crashes.
Recommendation
Immediately update the Linux kernel to a version containing the fix (bounds check added in sctp_unpack_cookie()).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.