CVE-2026-53246: Linux Kernel SCTP: missing bounds check on cached INIT chunk in COOKIE_ECHO
CVE-2026-53246 is a critical out-of-bounds write weakness (CWE-787) in the Linux kernel SCTP code. The CNA scored it 9.8 under CVSS 3.1, and the record notes that a missing length check on a cached INIT chunk can lead to out-of-bounds reads and memory corruption. The sources consulted do not show confirmed exploitation.
Overview
CVE-2026-53246 affects the SCTP (Stream Control Transmission Protocol) implementation in the Linux kernel. When a listening SCTP server handles a COOKIE_ECHO chunk, it parses a cached peer INIT chunk embedded after the cookie. The record states that the length of that cached chunk was not checked against the data actually received, so the later parameter walk may read past the buffer. The upstream fix adds a bounds check in sctp_unpack_cookie().
Impact
The record describes out-of-bounds reads and potential memory corruption during later parameter handling, including STATE_COOKIE processing and kmemdup() copies. The CWE is CWE-787 (Out-of-bounds Write). The CNA rates the issue 9.8 (Critical) under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability and high confidentiality, integrity and availability impact as scored by the CNA.
Affected products and versions
The record lists the product as Linux Linux Kernel with these version expressions:
- ≥ 2.6.12.1 and < 6.18.36
- ≥ 6.19 and < 7.0.13
- version 2.6.12, and the release candidates 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4 and 2.6.12-rc5
- version 7.1-rc1 through 7.1-rc6
The affected range is therefore described by the CNA data, not by a single product build. Distribution kernels may use backports, so the upstream version numbers should be checked against the vendor advisory for each system.
Exploitation status
The KEV catalog entry for this CVE is not listed in the record, so no active exploitation is confirmed by CISA KEV. No confirmed exploitation appears in the sources consulted. The EPSS value is not present in the record.
Remediation and mitigation
- Identify systems running Linux kernels within the affected ranges, including distribution kernels that may carry backported patches.
- Apply the upstream stable fixes referenced in the record, or the equivalent update from your Linux distribution or vendor.
- Where SCTP is not needed, consider disabling the SCTP kernel module or restricting SCTP traffic at network boundaries, as a temporary risk reduction measure.
- Prioritize internet-facing or multi-tenant hosts that accept SCTP associations.
The record does not provide a fixed version number for each branch. The upper bounds in the affected ranges (6.18.36 and 7.0.13) suggest where corrected builds start, but this is an inference and should be confirmed against the stable kernel release notes.
Detection guidance
- Review kernel logs for crashes, oops messages or memory corruption reports involving the SCTP subsystem.
- Inventory hosts where the SCTP module is loaded, since unnecessary loaded modules increase exposure.
- Monitor for unexpected SCTP traffic on hosts that do not normally use it.
These are high-level indicators only. The record does not describe specific observable signatures.
Limitations of the available information
The record does not include a vendor-specific advisory, a proof of concept, or confirmed exploitation data. The EPSS score is missing. The exact fixed version for each stable branch is not stated in the record, and the three cited patch commits were not reviewed in their full content. Conclusions about exploitability beyond the CNA score are unknown.
Frequently asked questions
What is the core problem in CVE-2026-53246?
The Linux kernel does not validate the length of a cached INIT chunk carried in a COOKIE_ECHO message against the data actually received, which can lead to out-of-bounds reads and memory corruption.
Is this vulnerability known to be actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Identify affected kernel versions, including distribution kernels, and apply the upstream stable fixes or your distribution's update. If SCTP is not needed, consider disabling it as a temporary measure.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.