CVE-2026-53246: Linux Kernel SCTP Buffer Overflow Flaw

CVE-2026-53246 Overview

CVE-2026-53246 is a Linux kernel vulnerability in the Stream Control Transmission Protocol (SCTP) implementation. The flaw occurs during COOKIE_ECHO chunk processing, where the cached peer INIT chunk length is not validated against the remaining buffer. An inflated length field allows sctp_walk_params() to read beyond the received data. The result is an out-of-bounds read with potential memory corruption during later parameter handling such as STATE_COOKIE processing and kmemdup() copies. The issue has been resolved upstream by adding a bounds check in sctp_unpack_cookie(). This vulnerability affects Linux kernel builds that include SCTP support and accept SCTP associations from network peers.

Critical Impact
A remote SCTP peer can trigger out-of-bounds reads and potential memory corruption in the kernel by sending a crafted COOKIE_ECHO chunk with an inflated cached INIT chunk length.

Affected Products

Linux kernel versions containing the vulnerable sctp_unpack_cookie() code path prior to the fixing commits
Linux distributions shipping SCTP-enabled kernels for server and networking workloads
Systems that operate as listening SCTP servers and process COOKIE_ECHO chunks from remote peers

Discovery Timeline

2026-06-25 - CVE-2026-53246 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53246

Vulnerability Analysis

The vulnerability resides in the SCTP four-way handshake completion logic. When a listening SCTP server processes an incoming COOKIE_ECHO chunk, the server retrieves the cached peer INIT chunk that was embedded inside the cookie. The sctp_unpack_cookie() function unpacks the cookie payload, and sctp_process_init() later walks the parameters of the embedded INIT chunk via sctp_walk_params().

The parameter walker relies on the chunk header length field to determine how far to iterate through the buffer. Because this length was never validated against the bytes actually remaining in the COOKIE_ECHO payload, an attacker who controls cookie contents can inflate the length and cause the walker to traverse memory past the end of the received data. The walk then drives downstream operations such as STATE_COOKIE parameter handling and kmemdup() copies on attacker-controlled boundaries.

The consequence is an out-of-bounds read in kernel space and a path to memory corruption depending on adjacent allocations. This class of issue typically maps to [CWE-125] Out-of-Bounds Read and [CWE-20] Improper Input Validation.

Root Cause

The root cause is missing length validation on a cached, peer-supplied INIT chunk header inside the COOKIE_ECHO payload. The kernel trusted a length field that should have been bounded by the remaining size of the received buffer before being passed to sctp_walk_params().

Attack Vector

The attack vector is the network. A remote peer that can establish an SCTP association toward a listening server can craft a COOKIE_ECHO chunk whose embedded INIT chunk advertises a length larger than the cookie buffer. No authentication is required at the SCTP layer to reach the vulnerable parser. Exploitation requires the target to have SCTP enabled and reachable.

The vulnerability is described in prose only; no public proof-of-concept code is referenced in the advisory. See the upstream commits for the patch implementation: Kernel Git Commit 0861615, Kernel Git Commit cc272185, and Kernel Git Commit edccbf3d.

Detection Methods for CVE-2026-53246

Indicators of Compromise

Unexpected kernel oops, KASAN, or slab-out-of-bounds reports referencing sctp_unpack_cookie, sctp_process_init, or sctp_walk_params in dmesg
Crashes or memory corruption traces on hosts running SCTP services shortly after receiving inbound COOKIE_ECHO traffic
Unusual SCTP association attempts toward listening ports from untrusted networks

Detection Strategies

Monitor kernel logs for SCTP-related stack traces and KASAN reports that intersect with cookie processing functions
Inspect SCTP traffic for COOKIE_ECHO chunks whose embedded INIT chunk length field exceeds the surrounding chunk payload size
Track kernel package versions across the fleet and flag hosts whose SCTP module predates the fixing commits

Monitoring Recommendations

Enable kernel address sanitizer or panic_on_oops in test environments to surface out-of-bounds reads triggered by malformed SCTP traffic
Forward dmesg and auditd events into a centralized data lake to correlate kernel faults with network flow records
Alert on repeated SCTP association failures or kernel module faults on hosts exposing SCTP to untrusted networks

How to Mitigate CVE-2026-53246

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the advisory and reboot affected hosts
Inventory all systems with the sctp kernel module loaded and prioritize internet-exposed or multi-tenant servers
Restrict inbound SCTP traffic to trusted peers using host or network firewalls until patches are deployed

Patch Information

The fix adds a bounds check in sctp_unpack_cookie() so that the cached INIT chunk length cannot exceed the available data in the COOKIE_ECHO buffer before parameter walking begins. The corrective changes are available in upstream stable kernels via Kernel Git Commit 0861615, Kernel Git Commit cc272185, and Kernel Git Commit edccbf3d. Pull the corresponding distribution kernel updates as soon as they become available.

Workarounds

Blacklist the sctp kernel module on hosts that do not require SCTP, for example by adding install sctp /bin/true to a modprobe.d configuration file
Block inbound IP protocol 132 (SCTP) at perimeter and host firewalls where the protocol is not in use
Limit SCTP listeners to internal interfaces and known peers to reduce exposure to untrusted senders

bash

# Configuration example
# Disable the SCTP module on systems that do not require it
echo 'install sctp /bin/true' | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true

# Block inbound SCTP (IP protocol 132) at the host firewall
sudo iptables -A INPUT -p 132 -j DROP
sudo ip6tables -A INPUT -p 132 -j DROP