CVE-2026-53224

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate embedded INIT chunk and address list lengths in cookie

sctp_unpack_cookie() only checked that the embedded INIT chunk length

did not exceed the remaining cookie payload, but did not ensure that the

INIT chunk is large enough to contain a complete INIT header.

A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose

length field is smaller than sizeof(struct sctp_init_chunk). Later,

sctp_process_init() accesses INIT parameters unconditionally, which may

lead to out-of-bounds reads.

In addition, raw_addr_list_len is not fully validated against the

remaining cookie payload. When cookie authentication is disabled, an

attacker can supply an oversized raw_addr_list_len and cause

sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The

address parser also lacks sufficient bounds checks for parameter headers

and lengths, allowing malformed address parameters to trigger

out-of-bound

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References