CVE-2026-64551

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SCTP implementation where the sctp sf do 5 2 6 stale() function fails to properly validate the length of a STALE COOKIE cause within an ERROR chunk when received in the COOKIE ECHOED state. The function reads a 4-byte Measure of Staleness following the cause header; however, it incorrectly references the first cause in the chunk rather than the specific STALE COOKIE cause. If the cause length is insufficient, the read operation extends beyond the cause or the socket buffer tail, resulting in the leakage of uninitialized memory to the peer via the Cookie Preservative of the reply INIT. This can be triggered by any peer capable of driving an association into the COOKIE ECHOED state, including unprivileged processes using raw SCTP sockets in user and network namespaces.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.