CVE-2026-53246

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

When a listening SCTP server processes a COOKIE_ECHO chunk, the cached

peer INIT chunk embedded after the cookie is parsed and its parameters

are later walked by sctp_process_init() using sctp_walk_params().

However, the chunk header length of this cached INIT chunk was not

validated against the remaining buffer in the COOKIE_ECHO payload. If

the length field is inflated, the parameter walk can run beyond the

actual received data, leading to out-of-bounds reads and potential

memory corruption during later parameter handling (e.g. STATE_COOKIE

processing and kmemdup() copies).

Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT

chunk length does not exceed the available data in the COOKIE_ECHO

buffer before it is used.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References