CVE-2026-53224

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate embedded INIT chunk and address list lengths in cookie

sctp_unpack_cookie() only checked that the embedded INIT chunk length

did not exceed the remaining cookie payload, but did not ensure that the

INIT chunk is large enough to contain a complete INIT header.

A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose

length field is smaller than sizeof(struct sctp_init_chunk). Later,

sctp_process_init() accesses INIT parameters unconditionally, which may

lead to out-of-bounds reads.

In addition, raw_addr_list_len is not fully validated against the

remaining cookie payload. When cookie authentication is disabled, an

attacker can supply an oversized raw_addr_list_len and cause

sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The

address parser also lacks sufficient bounds checks for parameter headers

and lengths, allowing malformed address parameters to trigger

out-of-bound

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References