CVE-2026-53004: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53004 Overview

CVE-2026-53004 is an out-of-bounds write vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in sctp_getsockopt_peer_auth_chunks(), which fails to account for the 8-byte struct sctp_authchunks header when validating the caller's optval buffer length. An unprivileged local userspace caller can trigger an 8-byte write past the declared buffer boundary in its own address space. The bytes written are under the remote peer's control via the SCTP AUTH chunk list, allowing silent corruption of adjacent userspace data structures.

Critical Impact
An unprivileged userspace caller with an SCTP association can cause the kernel to overwrite 8 bytes of adjacent userspace memory with peer-controlled AUTH chunk type data, violating the kernel-to-userspace memory contract.

Affected Products

Linux kernel SCTP subsystem (multiple stable branches addressed by fix commits)
Reproducer confirmed on kernel build v7.0-13-generic
Distributions shipping vulnerable SCTP code prior to upstream stable fixes

Discovery Timeline

2026-06-24 - CVE-2026-53004 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53004

Vulnerability Analysis

The vulnerability stems from an incomplete length check inside sctp_getsockopt_peer_auth_chunks() in the Linux kernel SCTP code. The function validates the user-supplied optval buffer with if (len < num_chunks) return -EINVAL;, then writes num_chunks bytes into p->gauth_chunks. The gauth_chunks field sits at offset 8 within struct sctp_authchunks, immediately following an 8-byte header. The check omits this sizeof(struct sctp_authchunks) header.

When the caller passes len == num_chunks for any positive num_chunks, the validation passes but copy_to_user() writes 8 bytes beyond the declared buffer. The sibling function sctp_getsockopt_local_auth_chunks() already performs the correct check: if (len < sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL;. The fix aligns the peer variant with this sibling pattern. This is classified as Out-of-Bounds Write [CWE-787] targeting userspace, not kernel memory.

Root Cause

The root cause is a missing addend in the boundary check. The validation compares len only against num_chunks while the actual write covers sizeof(struct sctp_authchunks) + num_chunks bytes. This is a kernel-side contract violation where the kernel writes outside the buffer the userspace caller declared.

Attack Vector

An unprivileged local process opens a loopback SCTP association with AUTH enabled and queries num_chunks using a short optval. The process then issues getsockopt() with len == num_chunks and sentinel bytes painted past the buffer. The kernel overwrites those sentinel bytes with the peer's AUTH chunk type. Because the peer controls the AUTH chunk type list during the association handshake, a remote or co-located peer can influence the 8 bytes written into the victim process's adjacent userspace memory.

// Vulnerable check (conceptual, no synthetic exploit code)
// In sctp_getsockopt_peer_auth_chunks():
//   if (len < num_chunks)            // missing sizeof(struct sctp_authchunks)
//           return -EINVAL;
//   copy_to_user(p->gauth_chunks, ..., num_chunks);  // writes past buffer
//
// Fixed check matches sctp_getsockopt_local_auth_chunks():
//   if (len < sizeof(struct sctp_authchunks) + num_chunks)
//           return -EINVAL;

Detection Methods for CVE-2026-53004

Indicators of Compromise

Unprivileged processes opening SCTP sockets with SCTP_AUTH_CHUNK enabled and issuing getsockopt(SCTP_PEER_AUTH_CHUNKS) with short buffers
Unexpected SCTP association establishment on loopback or low-privilege workloads not normally using SCTP
Process crashes or memory corruption symptoms in userspace applications consuming SCTP AUTH data

Detection Strategies

Audit kernel versions across the fleet and identify hosts running SCTP-enabled kernels predating the fix commits referenced in the upstream stable tree
Enable auditd rules on socket() and getsockopt() syscalls filtering for IPPROTO_SCTP to identify rare SCTP usage on endpoints
Hunt for processes loading the sctp kernel module in environments where SCTP is not a sanctioned protocol

Monitoring Recommendations

Track loading of the sctp.ko kernel module via modprobe and insmod telemetry
Alert on unprivileged processes creating SCTP sockets, particularly in container or multi-tenant environments
Monitor for repeated short-buffer getsockopt() probes against SCTP socket options characteristic of the disclosed reproducer pattern

How to Mitigate CVE-2026-53004

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits 0cf004ff, 2b5a2c95, 6849b995, 6bcf8fe4, 70a089cc, a132e199, d45c7e99, and d67fbc6d
Where SCTP is not required, blacklist the sctp kernel module to eliminate exposure entirely
Inventory userspace applications using SCTP AUTH and validate they handle getsockopt() results defensively

Patch Information

The fix replaces the incomplete length check in sctp_getsockopt_peer_auth_chunks() with if (len < sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL;, matching the sibling sctp_getsockopt_local_auth_chunks(). Patch commits are available in the upstream stable tree: Kernel Commit 0cf004ff, Kernel Commit 2b5a2c95, Kernel Commit 6849b995, Kernel Commit 6bcf8fe4, Kernel Commit 70a089cc, Kernel Commit a132e199, Kernel Commit d45c7e99, and Kernel Commit d67fbc6d.

Workarounds

Blacklist the SCTP module on systems that do not require it by adding blacklist sctp to /etc/modprobe.d/
Restrict SCTP socket creation using seccomp filters or Linux Security Modules to block IPPROTO_SCTP for untrusted processes
Disable SCTP AUTH extensions on applications that do not depend on peer chunk discovery

bash

# Disable the SCTP kernel module to mitigate exposure
echo "blacklist sctp" | sudo tee /etc/modprobe.d/blacklist-sctp.conf
echo "install sctp /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-sctp.conf
sudo rmmod sctp 2>/dev/null || true