Linux Kernel Vulnerability in SCTP Handling

CVE-2026-64551

What is CVE-2026-64551?

A vulnerability exists in the Linux kernel's SCTP module, where improper validation occurs when handling ERROR chunks with STALE_COOKIE causes. An attacker can exploit this flaw to read potentially sensitive data from uninitialized memory, leading to a data leak. The issue arises during the processing of the 4-byte Measure of Staleness, particularly when the staleness field is not properly validated beforehand. As such, unprivileged processes could inadvertently access this memory, potentially resulting in unintended information disclosure.

References