SCTP Vulnerability in Linux Kernel

CVE-2026-53246

What is CVE-2026-53246?

A vulnerability has been identified in the Linux Kernel that impacts the SCTP (Stream Control Transmission Protocol) handling mechanism. When a listening SCTP server processes a COOKIE_ECHO chunk, it improperly validates the length of the cached peer INIT chunk. This flaw allows for the possibility of reading beyond the actual data received, resulting in out-of-bounds memory reads, and potentially leading to memory corruption during the processing of parameters. To mitigate this issue, a bounds check has been implemented in the sctp_unpack_cookie() function, ensuring that the length of the cached INIT chunk does not exceed the available COOKIE_ECHO buffer data.

References