CVE-2026-53246

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could exploit this by sending a specially crafted COOKIE_ECHO chunk to a listening SCTP server. The server's failure to properly validate the length of a cached peer INIT chunk within the COOKIE_ECHO payload could lead to out-of-bounds reads and memory corruption. This could result in a denial of service or potentially information disclosure.

SCTP COOKIE_ECHO processing failed to validate the cached peer INIT chunk length against the remaining cookie buffer, allowing a remote SCTP peer to make parameter parsing walk beyond received data and potentially trigger OOB reads or later memory corruption in SCTP parameter handling. This allows sctp_process_init() and sctp_walk_params() to walk beyond the actual received buffer and can lead to out-of-bounds reads during later parameter handling such as STATE_COOKIE processing and kmemdup() copies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module sctp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.