CVE-2026-74752: sctp: validate cookie AUTH state before use
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate cookie AUTH state before use
When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays.
A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain.
Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed for exploitation?
An attacker needs to supply a forged SCTP COOKIE_ECHO containing peer-controlled cookie AUTH data. The vulnerable path applies when SCTP cookie authentication is disabled.
What is the potential impact?
Forged AUTH fields can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier can also trigger a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege-escalation chain.
Which malformed cookie fields are relevant?
The affected fields are RANDOM length, HMAC lists and identifiers, and CHUNKS lists. Invalid parameter types or lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk IDs are rejected by the fix.