CVE-2026-64551

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate STALE_COOKIE cause length before reading staleness

When an ERROR chunk with a STALE_COOKIE cause is received in the

COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure

of Staleness that follows the cause header:

err = (struct sctp_errhdr *)(chunk->skb->data);

stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));

err is the first cause in the chunk, not the STALE_COOKIE cause that

caused the dispatch, and nothing guarantees the staleness field is

present. sctp_walk_errors() only requires a cause to be as long as the

4-byte header, so for a STALE_COOKIE cause of length 4 the read runs

past the cause, and for a minimal ERROR chunk past skb->tail. The value

is echoed to the peer in the Cookie Preservative of the reply INIT,

leaking uninitialized memory.

sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so

check its length there and pass it to sctp_sf_do_5_2_6_st

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References