CVE-2026-53224 Overview
CVE-2026-53224 is a Linux kernel vulnerability in the Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in sctp_unpack_cookie(), which fails to fully validate the size of an embedded INIT chunk and the length of the raw address list inside a COOKIE_ECHO message. A malformed cookie can carry a truncated INIT chunk or an oversized raw_addr_list_len, causing subsequent parsing routines to read past the end of the cookie payload. This results in out-of-bounds reads in kernel memory [CWE-125].
Critical Impact
A remote peer transmitting a crafted SCTP COOKIE_ECHO can trigger out-of-bounds reads in the Linux kernel, potentially leading to information disclosure or denial of service when cookie authentication is disabled.
Affected Products
- Linux kernel SCTP subsystem (net/sctp/sm_make_chunk.c)
- Distributions shipping vulnerable kernel versions prior to the fixing commits
- Systems with SCTP enabled and cookie authentication disabled
Discovery Timeline
- 2026-06-25 - CVE-2026-53224 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53224
Vulnerability Analysis
The vulnerability exists in the SCTP cookie unpacking logic. sctp_unpack_cookie() previously verified only that the embedded INIT chunk length did not exceed the remaining cookie payload. It did not confirm that the INIT chunk was large enough to hold a complete struct sctp_init_chunk header.
When sctp_process_init() subsequently parses the chunk, it dereferences INIT parameters unconditionally. A truncated INIT chunk causes the parser to read memory beyond the valid INIT header. This produces out-of-bounds reads adjacent to the cookie buffer.
A secondary defect affects raw_addr_list_len. The field is not fully bounded against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an inflated raw_addr_list_len, causing sctp_raw_to_bind_addrs() to walk past the end of the cookie. The address parameter parser also lacks sufficient bounds checks for parameter headers and payload lengths.
Root Cause
The root cause is incomplete length validation in sctp_unpack_cookie(). The function trusted attacker-controlled length fields without enforcing minimum sizes for the embedded INIT chunk or verifying that the INIT chunk plus the raw address list fit within the cookie payload.
Attack Vector
An attacker sends a crafted SCTP COOKIE_ECHO packet to a vulnerable Linux host. The cookie payload contains either a truncated INIT chunk shorter than sizeof(struct sctp_init_chunk) or an oversized raw_addr_list_len. When the kernel processes the cookie, it performs out-of-bounds reads in kernel memory. Exploitation can leak adjacent kernel memory or destabilize the SCTP association.
No verified public proof-of-concept code is available. The patch details are documented in the upstream commits referenced below.
Detection Methods for CVE-2026-53224
Indicators of Compromise
- Unexpected kernel oops or KASAN reports referencing sctp_unpack_cookie, sctp_process_init, or sctp_raw_to_bind_addrs
- Anomalous SCTP COOKIE_ECHO traffic with malformed chunk length fields
- Sudden termination or instability of SCTP-dependent services such as telecom signaling stacks
Detection Strategies
- Enable KASAN on test kernels to surface out-of-bounds reads in the SCTP code path
- Inspect SCTP packet captures for COOKIE_ECHO messages whose declared INIT chunk length is below sizeof(struct sctp_init_chunk)
- Correlate kernel log entries from dmesg with network telemetry to identify hosts receiving malformed SCTP traffic
Monitoring Recommendations
- Audit hosts that load the sctp kernel module and restrict it where SCTP is not required
- Monitor for crashes or restarts of services binding SCTP sockets (for example, Diameter, M3UA, S1AP)
- Forward kernel logs to a centralized data lake for retroactive analysis of anomalous SCTP parser activity
How to Mitigate CVE-2026-53224
Immediate Actions Required
- Apply the upstream kernel patches referenced in the commit list below as soon as distribution updates are available
- Unload the sctp kernel module on systems that do not require SCTP
- Restrict ingress SCTP traffic at network boundaries to trusted peers only
Patch Information
The fix requires the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk), validates that the INIT chunk and raw address list together fit within the cookie payload, and verifies sufficient data exists for each address parameter header and payload before parsing. See Kernel Git Commit 7560afb, Kernel Git Commit 512a9bb, and Kernel Git Commit 6f4c80a.
Workarounds
- Blacklist the sctp kernel module using /etc/modprobe.d/ configuration where the protocol is unused
- Filter inbound SCTP traffic with iptables, nftables, or upstream firewalls to allow only trusted endpoints
- Disable automatic loading of the SCTP module by removing CONFIG_SCTP_* autoload triggers in environments without SCTP applications
# Blacklist the SCTP module on systems that do not need it
echo 'install sctp /bin/true' | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
