CVE-2026-53224: Linux kernel SCTP out-of-bounds read via unvalidated COOKIE_ECHO INIT chunk and address list
The Linux kernel SCTP cookie unpacking code does not fully validate the embedded INIT chunk length, the raw address list length, or address parameter headers, which can lead to out-of-bounds reads (CWE-125). The CNA assigned a CVSS 3.1 score of 9.1 with a network attack vector and no privileges or user interaction required. The record indicates no KEV listing and no confirmed exploitation in the sources consulted.
Overview
The fix addresses insufficient input validation in the Linux kernel SCTP cookie handling path. The embedded INIT chunk and the raw address list inside a COOKIE_ECHO cookie were not fully length-checked before being read, which is classified as CWE-125 (Out-of-bounds Read).
Impact
- Malformed COOKIE_ECHO data can cause the kernel to read memory beyond the intended cookie or chunk boundaries.
- The CNA-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) describes a network-reachable issue with high confidentiality and availability impact and no integrity impact, scored 9.1.
- The record states that the flaw is reachable when cookie authentication is disabled, which is a relevant configuration factor.
Affected products and versions
- Product listed: Linux Linux Kernel.
- Ranges listed in the record include versions from 2.6.12.1 up to, but not including, 6.18.36, and versions from 6.19 up to, but not including, 7.0.13.
- The record also lists individual versions 2.6.12 and several 7.1 release candidates from 7.1-rc1 to 7.1-rc7.
- The record does not map each stable branch to a specific fixed release; consult the linked stable kernel commits.
Exploitation status
The record shows KEV listing as false and no EPSS score. No confirmed exploitation is stated in the sources consulted.
Remediation and mitigation
- Apply the stable kernel updates that contain the referenced commits, using the vendor or distribution packages for your platform.
- Prioritize systems where SCTP is used and where cookie authentication is disabled, since the record highlights that configuration.
- If SCTP is not required, reducing its exposure by not loading the module is a general hardening measure (inference, not stated in the record).
- Note the record's statement that a related call-order change is planned as a separate patch.
Detection guidance
- Review kernel logs and inventory for systems running affected kernel ranges and for SCTP module usage.
- Monitor for unexpected SCTP association activity at the network perimeter as a high-level signal.
- Validate patch status by confirming the installed kernel build includes the referenced upstream commits.
Limitations of the available information
- The record gives no proof-of-concept details and no vendor advisory beyond kernel commits.
- The NVD score is not present in the record; the 9.1 score comes from the CNA entry.
- Exact fixed release numbers per branch are not explicitly provided.
Frequently asked questions
What is the core weakness in CVE-2026-53224?
The SCTP cookie unpacking code does not fully validate the embedded INIT chunk length, the raw address list length, or address parameter headers, which can cause out-of-bounds reads (CWE-125).
Is there confirmed exploitation of this CVE?
The record shows KEV listing as false and no EPSS score. No confirmed exploitation is stated in the sources consulted.
What should administrators do first?
Apply the Linux kernel stable updates that contain the referenced commits, prioritizing systems that use SCTP and have cookie authentication disabled.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.