CVE-2026-74752: Linux Kernel SCTP Privilege Escalation

CVE-2026-74752 Overview

CVE-2026-74752 is a Linux kernel vulnerability in the Stream Control Transmission Protocol (SCTP) subsystem. The flaw resides in the handling of COOKIE_ECHO chunks when cookie authentication is disabled. The kernel restores fixed-size AUTH fields directly from peer-controlled cookie bytes without validation. A remote attacker can forge RANDOM length values, HMAC lists, or CHUNKS lists that reach association consumers with unvalidated lengths and identifiers. Exploitation produces out-of-bounds reads during key-vector construction and a 32-byte out-of-bounds write past a zero-length AUTH chunk. The write primitive enables a local privilege escalation chain.

Critical Impact
Remote attackers can trigger out-of-bounds memory access in the Linux kernel SCTP stack, providing primitives for privilege escalation and kernel memory corruption.

Affected Products

Linux kernel (SCTP subsystem)
Distributions shipping affected kernel versions prior to the upstream fix
Systems with SCTP enabled and cookie authentication disabled

Discovery Timeline

2026-08-26 - CVE-2026-74752 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74752

Vulnerability Analysis

The vulnerability affects SCTP cookie processing in the Linux kernel. During the four-way handshake, the responder returns a state cookie to the initiator in INIT_ACK. The initiator echoes it back in COOKIE_ECHO. When cookie authentication is disabled, the kernel trusts the returned bytes and reconstructs AUTH-related fields directly from them.

The kernel copies the RANDOM parameter length, the HMAC identifier list, and the CHUNKS list from the cookie into the association state. These fields are then used to build key vectors and enforce authentication policy. Because the values are attacker-controlled, forged parameters bypass the checks normally applied during INIT/INIT_ACK processing.

Root Cause

The root cause is a missing trust boundary at cookie restoration. The AUTH extension parameters (RANDOM, HMACS, CHUNKS) are validated when first received in INIT, but the cookie path reintroduces them without revalidation. This is a classic input validation failure where a peer-controlled blob is treated as trusted internal state.

Attack Vector

A remote attacker initiates an SCTP association and manipulates the cookie contents returned in COOKIE_ECHO. A forged RANDOM length triggers out-of-bounds reads when the kernel builds the key vector. A forged HMAC identifier causes a 32-byte write past a zero-length AUTH chunk. The write primitive can corrupt adjacent kernel objects, enabling escalation to root on the local system. Because SCTP is exposed on the network stack, initial trigger requires no authentication.

The upstream fix validates cookie parameters at the trust boundary. Invalid parameter types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk identifiers are all rejected. See the Kernel Patch 3dbb44d and Kernel Patch 88619b1 for the corrected validation logic.

Detection Methods for CVE-2026-74752

Indicators of Compromise

Unexpected SCTP COOKIE_ECHO chunks from untrusted peers carrying malformed AUTH extension parameters
Kernel oops or KASAN reports referencing SCTP AUTH functions and key-vector construction paths
Sudden kernel panics or memory corruption traces originating from net/sctp/auth.c or related SCTP handlers
Unexplained privilege escalation events on hosts with SCTP-enabled workloads

Detection Strategies

Deploy kernel runtime integrity monitoring to catch out-of-bounds writes in SCTP code paths
Enable KASAN on test kernels to identify memory corruption during SCTP fuzzing
Alert on unusual SCTP traffic patterns, particularly malformed COOKIE_ECHO chunks with abnormal AUTH parameter sizes
Correlate kernel warnings with subsequent process privilege changes

Monitoring Recommendations

Ingest kernel logs into a central data lake and alert on BUG, WARNING, or KASAN messages referencing SCTP
Monitor for new local root shells or setuid process spawns following SCTP traffic to the host
Track loaded kernel versions across the fleet to identify unpatched systems exposing SCTP

How to Mitigate CVE-2026-74752

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the security advisory and reboot affected hosts
Identify all systems with the SCTP module loaded and prioritize patching for internet-exposed hosts
If patching is not immediately possible, blacklist the sctp kernel module on systems that do not require it
Restrict inbound SCTP traffic at network boundaries to trusted peers only

Patch Information

Fixes are available in mainline and stable Linux kernel trees. See Kernel Patch 3dbb44d and Kernel Patch 88619b1. Distribution vendors are expected to publish backports for supported kernel branches. Verify the running kernel version with uname -r and confirm the patched commit is included.

Workarounds

Unload and blacklist the SCTP kernel module on hosts that do not require it
Enforce firewall rules blocking SCTP (IP protocol 132) from untrusted networks
Enable cookie authentication where SCTP is required, because the vulnerable path is only reached when authentication is disabled

bash

# Blacklist the SCTP module to prevent load
echo "blacklist sctp" | sudo tee /etc/modprobe.d/blacklist-sctp.conf
echo "install sctp /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-sctp.conf

# Remove the module if currently loaded
sudo rmmod sctp

# Block SCTP at the host firewall (protocol 132)
sudo iptables -A INPUT -p 132 -j DROP