Executive brief
The Linux kernel's SCTP (Stream Control Transmission Protocol) network stack contains a vulnerability in the cookie-based handshake mechanism used to establish connections. When cookie authentication is disabled, attackers can send crafted COOKIE-ECHO messages with tampered INIT chunks that bypass validation, potentially allowing them to hijack or disrupt SCTP connections. This affects systems relying on SCTP for critical network communications, such as telecommunications and real-time media protocols.
Technical details
The vulnerability exists in the SCTP handshake implementation where the server embeds an INIT chunk into a cookie sent via INIT-ACK. When the client returns this cookie via COOKIE-ECHO, the server unpacks and reconstructs the original INIT chunk. With cookie authentication enabled, the cookie is cryptographically protected, making tampering detection automatic. However, when cookie_auth_enable is disabled, the reconstructed INIT chunk is reused without validation, allowing an attacker to inject a malformed or tampered INIT chunk. The fix adds explicit sctp_verify_init() validation after cookie unpacking in the COOKIE-ECHO processing paths (sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook()) when cookie authentication is disabled, validates the embedded chunk type before processing, and corrects parameter boundary checks to use the actual INIT chunk length rather than the buffer end.
Affected products
- Linux Linux kernel 2.6.12 and later (all stable branches through 7.2)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-06-27: patched: Upstream commit 414c5447fe6a200613dd46d7fdc8454622076cb1 merged
- 2026-07-24: other: Backported to stable kernel branches via commit 062bcbf8d1f1051fdeb20b94920031b0e2cb95a2