CVE-2026-74752

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP). When cookie authentication is disabled, the system improperly validates authentication (AUTH) fields restored directly from peer-controlled cookie bytes. A local attacker could exploit this by forging RANDOM lengths or HMAC identifiers within these cookies. This could lead to out-of-bounds reads and, more critically, a 32-byte write past a zero-length AUTH chunk, providing a primitive for local privilege escalation.

This Important flaw in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation could allow a local attacker to achieve privilege escalation. When SCTP cookie authentication is disabled, the kernel fails to properly validate AUTH fields from peer-controlled cookie bytes, leading to out-of-bounds memory access. This could result in a local privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the sctp kernel module from loading by creating a blacklist configuration as detailed below.

How do I prevent a kernel module from loading automatically? ↗

Note: Disabling the sctp module may impact services that rely on SCTP for communication. A system reboot is required for the mitigation to be fully applied.