CVE-2026-74752

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SCTP implementation where the COOKIE ECHO process restores fixed-size AUTH fields directly from peer-controlled cookie bytes when cookie authentication is disabled. This allows forged RANDOM lengths, HMAC lists, or CHUNKS lists to reach association consumers without being validated against local backing arrays. A forged RANDOM length can lead to out-of-bounds reads during key-vector-construction, while a forged HMAC identifier can result in a 32-byte write past a zero-length AUTH chunk, potentially enabling a local privilege escalation chain.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.