CVE-2026-53225: Linux Kernel SCTP ASCONF Uninitialized Read
CVE-2026-53225 is a Linux kernel SCTP flaw in ASCONF address parameter handling that can cause an uninitialized memory read. The CNA rates it 9.1 (Critical) under CVSS 3.1, and the record links fixes in several stable kernel branches. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-53225 affects the SCTP implementation of the Linux kernel. The record describes an uninitialized-value read in __sctp_rcv_asconf_lookup() in net/sctp/input.c, classified as CWE-908 (Use of Uninitialized Resource). The NVD and CVE Record pages are listed as source pages for this analysis.
Impact
According to the description, an unauthenticated SCTP peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but ends after the 4-byte parameter header. On the no-association lookup path, the kernel may then read up to 16 bytes of uninitialized memory. The CNA scores the issue 9.1 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
The record does not state the observable consequence of that read, such as whether data is disclosed to the peer or whether a crash can occur. These outcomes are unknown from the available data.
Affected products and versions
The record lists the Linux Kernel product with these ranges:
- From 2.6.25 before 5.10.259
- From 5.11 before 5.15.210
- From 5.16 before 6.1.176
- From 6.2 before 6.6.143
- From 6.7 before 6.12.94
- From 6.13 before 6.18.36
- From 6.19 before 7.0.13
- Release candidates 7.1-rc1 through 7.1-rc7
Versions outside these ranges are not listed as affected in the record. Distribution kernels may backport fixes differently, so vendor advisories should be checked for their own version information.
Exploitation status
The record shows no KEV catalog entry for this CVE (listed: false). No confirmed exploitation appears in the sources consulted, and this analysis does not claim active exploitation.
Remediation and mitigation
The record links eight stable kernel commits as fixes, including commit 928dd94db23e8ba340f83d68f7f24d831b7a4426. The primary remediation is to update to a kernel build from a branch that includes the fix.
- Check your distribution or vendor advisory to confirm which kernel build contains the backported fix.
- The record does not describe a workaround.
- As a general defensive option outside the sources, administrators who do not need SCTP may consider disabling the SCTP module where their platform supports it. This is an inference and should be validated before use.
Detection guidance
At a high level, teams can inventory hosts running the affected kernel branches, determine whether SCTP is loaded or reachable from untrusted networks, and review kernel logs and network telemetry for unusual SCTP traffic on exposed services. The record provides no specific indicators, and none are provided here.
Limitations of the available information
- The record title is null, so the titles in this analysis are derived from the description.
- No EPSS score or SSVC data is present in the record.
- The record does not describe a workaround.
- Distribution-specific fix status is not included in the record.
- The description says the fix follows the same class as an earlier commit, but it does not describe the full patch contents.
Frequently asked questions
What is CVE-2026-53225?
It is an uninitialized-value read in the Linux kernel SCTP ASCONF handling code, where a truncated IPv6 address parameter can cause the kernel to read past the declared data.
Is this vulnerability actively exploited?
The record does not list this CVE in the KEV catalog, and no confirmed exploitation appears in the sources consulted.
How can I reduce risk?
Update to a kernel build that includes the fix for your branch, check your vendor advisory for backports, and consider disabling SCTP if your environment does not need it.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.