---
id: CVE-2026-74752
title: 'sctp: validate cookie AUTH state before use'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sctp: validate cookie AUTH state before use

  When cookie authentication is disabled, COOKIE_ECHO restores fixed-size
  AUTH fields directly from peer-controlled cookie by…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1f485649f52929d9937b346a920a522a7363e202 <
    88619b117be1daf633ce32210570ce35a0bd1c98
  - >-
    Linux >= 1f485649f52929d9937b346a920a522a7363e202 <
    3dbb44d88b1e94dd31fe43588af7437b34b44d56
  - Linux 2.6.24
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:16:25.350604Z'
published: '2026-08-26'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:26:24.210Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74752'
references:
  - url: 'https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98'
  - url: 'https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56'
tags:
  - cve.org
epss: 0.00435
epssPercentile: 0.36304
ingestedAt: '2026-10-16T19:46:24.322Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cookie AUTH state before use

When cookie authentication is disabled, COOKIE_ECHO restores fixed-size
AUTH fields directly from peer-controlled cookie bytes.  A forged RANDOM
length, HMAC list, or CHUNKS list can then reach association consumers
with lengths or identifiers that were never validated against the local
backing arrays.

A forged RANDOM length can cause out-of-bounds reads during key-vector
construction.  A forged HMAC identifier also caused a 32-byte write past
a zero-length AUTH chunk, providing a primitive for a local privilege
escalation chain.

Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie
trust boundary before copying them into the association.  Reject invalid
types, malformed lengths, unsupported HMAC identifiers, HMAC lists
without SHA1, and forbidden chunk ids.

## Affected

- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 88619b117be1daf633ce32210570ce35a0bd1c98`
- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 3dbb44d88b1e94dd31fe43588af7437b34b44d56`
- `Linux 2.6.24`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.