CVE-2026-53004

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.0-13-generic

Description An out-of-bounds write to userspace exists in the sctp getsockopt peer auth chunks() function. The function fails to account for the 8-byte header of the struct sctp authchunks when validating the size of the optval buffer. If a caller provides a buffer length len equal to num chunks, the check passes, but copy to user() writes 8 bytes beyond the declared buffer. This allows an unprivileged userspace caller to have adjacent userspace data silently corrupted by bytes controlled by the peer, representing a kernel-side contract violation.

Recommendations Update the Linux kernel to a version where the sctp getsockopt peer auth chunks() function is aligned with sctp getsockopt local auth chunks() to correctly validate buffer length including the header size.