Executive brief
A vulnerability in the Linux kernel's SCTP networking protocol could allow a remote attacker to cause system instability or memory corruption. SCTP is a protocol used for transporting data over networks, often in telecommunications or specialized server environments. By sending a specially crafted network packet, an attacker could trigger an out-of-bounds memory read, potentially leading to a system crash or unauthorized access to sensitive information in memory.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's SCTP implementation within the 'sctp_unpack_cookie' function in 'net/sctp/sm_make_chunk.c'. When a listening SCTP server processes a COOKIE_ECHO chunk, it fails to validate the length of the cached peer INIT chunk header against the remaining buffer size. An attacker can provide an inflated length field, causing 'sctp_walk_params' to read beyond the received data buffer. This can result in memory corruption during subsequent 'kmemdup' operations or STATE_COOKIE processing. The issue has been resolved by adding explicit bounds checking in 'sctp_unpack_cookie'.
Affected products
- Linux Linux Kernel 2.6.12 to 6.18.36, 7.0.13
Timeline
- 2026-06-01: other: Patch authored
- 2026-06-25: disclosed: CVE published