Executive brief
The Linux kernel's SCTP networking protocol contains a vulnerability in how it processes authentication cookies when cookie authentication is disabled. An attacker can forge SCTP cookie parameters to trigger out-of-bounds memory reads or writes, potentially allowing privilege escalation or service disruption on systems using SCTP.
Technical details
The vulnerability exists in the SCTP AUTH chunk handling when cookie authentication is disabled. When processing COOKIE_ECHO messages, the kernel restores fixed-size AUTH fields (RANDOM, HMAC list, CHUNKS list) directly from peer-supplied cookie bytes without proper validation. A forged RANDOM length causes out-of-bounds reads during key-vector construction. A forged HMAC identifier can cause a 32-byte heap write past a zero-length AUTH chunk, creating a local privilege escalation primitive. The fix adds comprehensive validation of these parameters at the cookie trust boundary before they are restored into the association, rejecting invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk IDs. This is a kernel-level fix requiring patching.
Affected products
- Linux Linux kernel 2.6.11 through at least 6.19 (all versions with SCTP AUTH support)
Timeline
- 2026-08-26: disclosed
- 2026-08-07: patched: Patch committed upstream