CVE-2026-53225

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SCTP implementation where the sctp rcv asconf lookup() function in net/sctp/input.c fails to properly validate the length of an ASCONF chunk. The function verifies if the chunk can hold the ADDIP header and a parameter header, but then calls af->from addr param(), which reads the full address based on the parameter's declared length without further bounds checking. An unauthenticated peer can exploit this by sending a truncated trailing ASCONF chunk that declares an IPv6 address parameter but ends prematurely after the 4-byte parameter header. This causes the receive path to read up to 16 bytes of uninitialized memory past the truncated parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.