CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1Fixed in 7.2.8-1 - Compensating control
In SCTP cookie processing, require the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk), validate that the INIT chunk and raw address list together fit within the cookie payload, and verify sufficient data exists for each address parameter header and payload before parsing. When cookie authentication is disabled, call sctp_verify_init() after sctp_unpack_cookie() and before sctp_process_init().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53224?
CVE-2026-53224 has a critical severity rating of 9.1.
How do I fix CVE-2026-53224?
To fix CVE-2026-53224, apply the available patch from the Linux kernel update.
What vulnerabilities does CVE-2026-53224 address?
CVE-2026-53224 addresses an issue in the Linux kernel related to the validation of embedded INIT chunk and address list lengths.
What are the potential impacts of CVE-2026-53224?
The potential impacts of CVE-2026-53224 include denial of service due to improper handling of SCTP packets.
Is CVE-2026-53224 specific to a certain version of the Linux kernel?
CVE-2026-53224 affects specific versions of the Linux kernel that include the vulnerable sctp_unpack_cookie() function.