{"id":"CVE-2026-53246","title":"sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cc272185c9a9a4b7febc2de52eeaa3d00f19091e","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < edccbf3d63b0a3362bc916ea72edacc1e1ca456a","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0861615c28de668669d748ef4eb913ea9262d13b","Linux 2.6.12"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:27:37.139455Z"},"published":"2026-06-25","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:31:42.733Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53246","references":[{"url":"https://git.kernel.org/stable/c/cc272185c9a9a4b7febc2de52eeaa3d00f19091e"},{"url":"https://git.kernel.org/stable/c/edccbf3d63b0a3362bc916ea72edacc1e1ca456a"},{"url":"https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b"}],"tags":["cve.org"],"epss":0.00442,"epssPercentile":0.36957,"ingestedAt":"2026-10-16T17:24:46.739Z","slug":"CVE-2026-53246","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded after the cookie is parsed and its parameters\nare later walked by sctp_process_init() using sctp_walk_params().\n\nHowever, the chunk header length of this cached INIT chunk was not\nvalidated against the remaining buffer in the COOKIE_ECHO payload. If\nthe length field is inflated, the parameter walk can run beyond the\nactual received data, leading to out-of-bounds reads and potential\nmemory corruption during later parameter handling (e.g. STATE_COOKIE\nprocessing and kmemdup() copies).\n\nAdd a bounds check in sctp_unpack_cookie() to ensure the cached INIT\nchunk length does not exceed the available data in the COOKIE_ECHO\nbuffer before it is used.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cc272185c9a9a4b7febc2de52eeaa3d00f19091e`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < edccbf3d63b0a3362bc916ea72edacc1e1ca456a`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0861615c28de668669d748ef4eb913ea9262d13b`\n- `Linux 2.6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}