SB2026062679 - Out-of-bounds read in Linux kernel sctp

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-53246)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information or cause memory corruption.

The vulnerability exists due to an out-of-bounds read in sctp_unpack_cookie() and cached peer INIT chunk processing when processing a crafted COOKIE_ECHO chunk. A remote attacker can send a specially crafted COOKIE_ECHO chunk with an inflated cached INIT chunk length to disclose sensitive information or cause memory corruption.

The issue occurs in a listening SCTP server while walking parameters from the cached peer INIT chunk embedded after the cookie.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b
• https://git.kernel.org/stable/c/cc272185c9a9a4b7febc2de52eeaa3d00f19091e
• https://git.kernel.org/stable/c/edccbf3d63b0a3362bc916ea72edacc1e1ca456a