CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.12-1Fixed in 7.1.13-1 - Configuration
Modify sctp_unpack_cookie() so it (1) rejects cookies where the embedded INIT chunk length is smaller than sizeof(struct sctp_init_chunk), (2) checks that the INIT chunk and the raw address list together fit within the remaining cookie payload, and (3) performs bounds checks to ensure enough bytes exist for each address parameter header and its payload before parsing.
Linux kernel SCTP cookie parsing sctp_unpack_cookie() validation = Require embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk) and validate INIT chunk + raw address list fit within cookie payload; verify sufficient data exists for each address parameter header and payload before parsing. - Compensating control
When cookie authentication is disabled, ensure call order enforces sctp_verify_init() after sctp_unpack_cookie() and before sctp_process_init() to prevent out-of-bounds reads caused by unconditionally accessing INIT parameters.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53224?
CVE-2026-53224 has a critical severity rating of 9.1.
How do I fix CVE-2026-53224?
To fix CVE-2026-53224, apply the available patch from the Linux kernel update.
What vulnerabilities does CVE-2026-53224 address?
CVE-2026-53224 addresses an issue in the Linux kernel related to the validation of embedded INIT chunk and address list lengths.
What are the potential impacts of CVE-2026-53224?
The potential impacts of CVE-2026-53224 include denial of service due to improper handling of SCTP packets.
Is CVE-2026-53224 specific to a certain version of the Linux kernel?
CVE-2026-53224 affects specific versions of the Linux kernel that include the vulnerable sctp_unpack_cookie() function.