SB20260815321 - Improper input validation in Linux kernel sctp

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-72398)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to tamper with SCTP association handling and cause a denial of service.

The vulnerability exists due to improper input validation in SCTP COOKIE-ECHO processing paths when processing a cookie containing a reconstructed INIT chunk while cookie authentication is disabled. A remote attacker can send a specially crafted COOKIE-ECHO packet to tamper with SCTP association handling and cause a denial of service.

The issue only arises when cookie authentication is disabled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/062bcbf8d1f1051fdeb20b94920031b0e2cb95a2
• https://git.kernel.org/stable/c/414c5447fe6a200613dd46d7fdc8454622076cb1
• https://git.kernel.org/stable/c/bca3100f550281c2f2418652338bced3b35af0e6