SB2026062699 - Out-of-bounds read in Linux kernel sctp

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-53224)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in SCTP cookie processing in sctp_unpack_cookie(), sctp_process_init(), and sctp_raw_to_bind_addrs() when handling a malformed COOKIE_ECHO containing a truncated embedded INIT chunk or malformed address parameters. A remote attacker can send a specially crafted COOKIE_ECHO to cause a denial of service.

When cookie authentication is disabled, an oversized raw address list length can also be used to trigger the out-of-bounds read condition.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/512a9bb77c04ac9927648ea58af617e472be96e6
• https://git.kernel.org/stable/c/6f4c80a2a7e6d06753b89a578b710a2499a5e62b
• https://git.kernel.org/stable/c/7560afb8cddafd829e709d7ea09230e45a825557