CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-25 · updated 2026-10-19
Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.

Affected products

Linux kernel: from 2.6.12.1 before 6.18.36; from 6.19 before 7.0.13; 2.6.12, 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4, 2.6.12-rc5, 7.1-rc1 (+5) — fixed in 6.18.36, 7.0.13

How to fix

Upgrade to a fixed version: Linux kernel 6.18.36, 7.0.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-53246 or the next vulnerability affects your stack