---
id: CVE-2026-53246
title: 'sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached
  peer INIT chunk embedded …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    cc272185c9a9a4b7febc2de52eeaa3d00f19091e
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    edccbf3d63b0a3362bc916ea72edacc1e1ca456a
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    0861615c28de668669d748ef4eb913ea9262d13b
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:27:37.139455Z'
published: '2026-06-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:42.733Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53246'
references:
  - url: 'https://git.kernel.org/stable/c/cc272185c9a9a4b7febc2de52eeaa3d00f19091e'
  - url: 'https://git.kernel.org/stable/c/edccbf3d63b0a3362bc916ea72edacc1e1ca456a'
  - url: 'https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b'
tags:
  - cve.org
epss: 0.00442
epssPercentile: 0.36957
ingestedAt: '2026-10-16T17:24:46.739Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

When a listening SCTP server processes a COOKIE_ECHO chunk, the cached
peer INIT chunk embedded after the cookie is parsed and its parameters
are later walked by sctp_process_init() using sctp_walk_params().

However, the chunk header length of this cached INIT chunk was not
validated against the remaining buffer in the COOKIE_ECHO payload. If
the length field is inflated, the parameter walk can run beyond the
actual received data, leading to out-of-bounds reads and potential
memory corruption during later parameter handling (e.g. STATE_COOKIE
processing and kmemdup() copies).

Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT
chunk length does not exceed the available data in the COOKIE_ECHO
buffer before it is used.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cc272185c9a9a4b7febc2de52eeaa3d00f19091e`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < edccbf3d63b0a3362bc916ea72edacc1e1ca456a`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0861615c28de668669d748ef4eb913ea9262d13b`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.