Executive brief
A vulnerability was identified in the Linux kernel's implementation of the SCTP protocol, which is used for transporting data over networks. An unprivileged user could trigger a situation where the kernel writes data slightly past the end of a memory buffer provided by an application. While this does not crash the system or leak secret kernel information, it can cause an application to unknowingly have its own memory corrupted, potentially leading to unpredictable behavior or crashes of that specific application.
Technical details
An out-of-bounds (OOB) write vulnerability exists in net/sctp/socket.c within the sctp_getsockopt_peer_auth_chunks() function. The root cause is an incorrect length validation check: the function verifies that the user-provided buffer length is greater than the number of chunks, but fails to account for the 8-byte header (struct sctp_authchunks) that precedes the chunk data in the destination buffer. Consequently, when a caller provides a buffer exactly equal to the number of chunks, copy_to_user() writes 8 bytes past the end of the user-supplied buffer. This is a kernel-to-userspace OOB write; while it does not corrupt kernel memory, it allows an unprivileged local attacker to corrupt adjacent memory within their own process space or potentially other processes sharing memory. The issue has been resolved by correcting the length check to include the header size.
Affected products
- Linux Linux Kernel v7.0-13-generic
Timeline
- 2026-04-15: other: Vulnerability fixed in source code
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0cf004ffb61cd32d140531c3a84afe975f9fc7ea
- https://git.kernel.org/stable/c/2b5a2c957c7769d40110f725cf23987fcef50d75
- https://git.kernel.org/stable/c/6849b995cda88a677bf08a05765d1db7905974fc
- https://git.kernel.org/stable/c/6bcf8fe4ef7967b22b814cbae9a57bbd3c853410
- https://git.kernel.org/stable/c/70a089cc9590aa347a61e84434116ab74619e3c3
- https://git.kernel.org/stable/c/a132e199de69e2a45628aa8534df1bf5d44e1b6e
- https://git.kernel.org/stable/c/d45c7e99caf915b0f6c716bd8ffe9d45b9685761