CVE-2026-53224

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SCTP implementation where sctp unpack cookie() fails to ensure that the embedded INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE ECHO can contain a truncated INIT chunk with a length smaller than sizeof(struct sctp init chunk), which may lead to out-of-bounds reads when sctp process init() accesses INIT parameters unconditionally. Additionally, when cookie authentication is disabled, the raw addr list len variable is not fully validated against the remaining cookie payload. This allows an attacker to provide an oversized raw addr list len, causing sctp raw to bind addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, which can trigger further out-of-bounds reads via malformed address parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.