Executive brief
A vulnerability in the Linux kernel's implementation of the SCTP networking protocol could allow an unauthenticated remote attacker to trigger an information leak. By sending a specially crafted, truncated network packet, an attacker can cause the system to read up to 16 bytes of uninitialized memory. While this specific bug primarily results in reading internal memory data, it represents a flaw in how the system validates incoming network traffic.
Technical details
A vulnerability exists in net/sctp/input.c within the __sctp_rcv_asconf_lookup() function of the Linux kernel. The function fails to properly validate the length of ASCONF chunks before calling af->from_addr_param(), which reads a full address (up to 16 bytes for IPv6) based on the parameter's declared length. An unauthenticated remote attacker can send a truncated ASCONF chunk that declares an IPv6 address parameter but ends prematurely. This causes the kernel to read uninitialized bytes past the end of the parameter during the association lookup path. The issue has been resolved by adding a bounds check to ensure the entire address parameter fits within the received chunk.
Affected products
- Linux Linux Kernel df2185771439 to 446e0ecd845a, 928dd94db23e, d796cfd06074, 8ce96f118264, d6bd0bb7697e, f76a8b323e28, 8e86817b8af4, f8373d7090b7
Timeline
- 2026-06-08: other: Patch authored
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/446e0ecd845abc394b24ae2030a883572bec9d16
- https://git.kernel.org/stable/c/8ce96f1182644079249a24ac7e2ffc32e0301a46
- https://git.kernel.org/stable/c/8e86817b8af4d552f3c6fe04ca52bb0c8c57411d
- https://git.kernel.org/stable/c/928dd94db23e8ba340f83d68f7f24d831b7a4426
- https://git.kernel.org/stable/c/d6bd0bb7697ea8c0387b0d9d973453f479017b23
- https://git.kernel.org/stable/c/d796cfd06074b579d265b28401306cadd30db945
- https://git.kernel.org/stable/c/f76a8b323e28e0951f979dbef20a7496383c47df