CVE-2026-53246

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the SCTP server's processing of COOKIE ECHO chunks. When parsing the cached peer INIT chunk embedded after the cookie, the system fails to validate the chunk header length against the remaining buffer in the COOKIE ECHO payload. If the length field is inflated, the sctp walk params() function, called by sctp process init(), may read beyond the actual received data. This can result in out-of-bounds reads and potential memory corruption during subsequent parameter handling, such as kmemdup() copies and STATE COOKIE processing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.