CVE-2026-64551: Linux Kernel Information Disclosure Bug

CVE-2026-64551 Overview

CVE-2026-64551 is a Linux kernel vulnerability in the Stream Control Transmission Protocol (SCTP) subsystem. The flaw resides in sctp_sf_do_5_2_6_stale(), which reads a 4-byte Measure of Staleness field without validating that the STALE_COOKIE cause is long enough to contain it. The kernel then echoes the value back to the peer inside the Cookie Preservative parameter of the reply INIT chunk, leaking uninitialized kernel memory across the network.

Critical Impact
Any unprivileged local process or remote peer that can drive an SCTP association into the COOKIE_ECHOED state can trigger reads past the cause boundary or past skb->tail, exposing uninitialized kernel memory to the network.

Affected Products

Linux kernel (SCTP subsystem, multiple stable branches)
Distributions shipping vulnerable kernels prior to the referenced stable commits
Systems where unprivileged users can create user and network namespaces with raw SCTP sockets

Discovery Timeline

2026-07-27 - CVE-2026-64551 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64551

Vulnerability Analysis

The vulnerability is an out-of-bounds read leading to information disclosure [CWE-125, CWE-908]. When an ERROR chunk containing a STALE_COOKIE cause arrives while an SCTP endpoint is in the COOKIE_ECHOED state, the handler sctp_sf_do_5_2_6_stale() casts chunk->skb->data to a struct sctp_errhdr * and reads the 4 bytes immediately following the cause header as the staleness value.

That pointer refers to the first cause in the ERROR chunk, not necessarily the STALE_COOKIE cause that triggered dispatch. sctp_walk_errors() only requires each cause to be at least as long as the 4-byte cause header, so a STALE_COOKIE cause carrying only its header causes the read to run past the cause. For a minimal ERROR chunk, the read runs past skb->tail into adjacent socket buffer memory. The retrieved value is placed into the Cookie Preservative parameter of the outgoing INIT reply, exfiltrating uninitialized kernel memory to the remote peer.

Root Cause

The root cause is a missing length validation on the STALE_COOKIE cause before the staleness field is dereferenced. The handler assumes the presence of a 4-byte Measure of Staleness immediately after the cause header, but SCTP parsing routines accept causes that consist of the header alone.

Attack Vector

The read is reachable by any peer capable of driving an SCTP association into the COOKIE_ECHOED state. This includes unprivileged local processes using raw SCTP sockets inside user and network namespaces. An attacker sends a crafted ERROR chunk whose first cause is either a truncated STALE_COOKIE (length 4) or another cause type that leaves the staleness bytes uninitialized. The kernel then reflects up to 4 bytes of adjacent kernel memory back to the attacker in the Cookie Preservative of the INIT reply. Repeated triggers can be used to progressively harvest memory contents.

No verified public exploit code is available. See the upstream fixes for technical details, including commit 08a8f2d13f70 and commit 861f884f5471.

Detection Methods for CVE-2026-64551

Indicators of Compromise

Unexpected SCTP ERROR chunks containing STALE_COOKIE causes with length equal to 4 (header only) sent to hosts running vulnerable kernels
Outbound SCTP INIT chunks carrying Cookie Preservative parameters with anomalous, non-monotonic staleness values that suggest reflected memory content
Unprivileged processes opening raw SCTP sockets from within user or network namespaces on multi-tenant systems

Detection Strategies

Inspect SCTP traffic at network sensors for malformed ERROR chunks whose cause length field does not accommodate the documented cause payload
Correlate association state transitions into COOKIE_ECHOED with subsequent INIT retransmissions carrying Cookie Preservative parameters
Audit kernel versions against the fixed stable commits and flag hosts still running pre-patch builds that expose SCTP to untrusted peers

Monitoring Recommendations

Log and alert on user namespace creation combined with raw SCTP socket use by non-root processes
Enable kernel memory sanitizer (KMSAN) or KASAN builds in test environments to surface uninitialized reads in sctp_sf_do_5_2_6_stale()
Monitor for repeated SCTP INIT/COOKIE_ECHO/ERROR handshake cycles from a single peer, which is consistent with iterative memory harvesting

How to Mitigate CVE-2026-64551

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected hosts
Inventory systems that load the sctp module and prioritize patching those exposed to untrusted networks or multi-tenant workloads
Restrict unprivileged user namespace creation on hosts where SCTP is not required by workload

Patch Information

The fix reworks sctp_sf_cookie_echoed_err() to locate the STALE_COOKIE cause via sctp_walk_errors(), verify its length is sufficient to hold the 4-byte staleness field, and pass that validated cause to sctp_sf_do_5_2_6_stale(). A STALE_COOKIE cause too short to contain the staleness field is discarded. Fixed builds are available in the stable branches referenced by the following commits: 08a8f2d13f70, 1cd23ca80784, 588706ebaf8c, 6022da377867, 861f884f5471, a257b41ddfe9, bbd6b2ea966c, and ebe0a55d954f.

Workarounds

Blacklist the sctp kernel module on hosts that do not require SCTP: add blacklist sctp to /etc/modprobe.d/ and reload initramfs
Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 on distributions that expose this tunable
Filter inbound SCTP traffic at the network perimeter to block untrusted sources from initiating associations with affected hosts

bash

# Configuration example: disable SCTP module loading and restrict user namespaces
echo 'install sctp /bin/true' | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee -a /etc/sysctl.d/99-harden.conf