CVE-2026-53004

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks

sctp_getsockopt_peer_auth_chunks() checks that the caller's optval

buffer is large enough for the peer AUTH chunk list with

if (len < num_chunks)

return -EINVAL;

but then writes num_chunks bytes to p->gauth_chunks, which lives

at offset offsetof(struct sctp_authchunks, gauth_chunks) == 8

inside optval. The check is missing the sizeof(struct

sctp_authchunks) = 8-byte header. When the caller supplies

len == num_chunks (for any num_chunks > 0) the test passes but

copy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes

past the declared buffer.

The sibling function sctp_getsockopt_local_auth_chunks() at the

next line already has the correct check:

if (len < sizeof(struct sctp_authchunks) + num_chunks)

return -EINVAL;

Align the peer variant with its sibling.

Reproducer confirms on v7.0-13-generic: an unprivi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References