UBUNTU-CVE-2026-72398: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, where the server unpacks it and reconstructs the original INIT chunk. When cookie authentication is enabled, the cookie contents are protected against tampering, so reusing the unpacked INIT without re-verification is safe. However, when cookie authentication is disabled, the reconstructed INIT can no longer be trusted. In this case, the INIT must be explicitly validated after unpacking to avoid processing potentially tampered data. Add sctpverifyinit() checks after cookie unpacking in COOKIE-ECHO processing paths (sctpsfdo51Dce() and sctpsfdo524dupcook()) when cookieauthenable is disabled. On failure, the new association is freed and the packet is discarded. Also tighten cookie validation in sctpunpackcookie() by verifying the embedded chunk type is SCTPCIDINIT before treating it as an INIT chunk. Finally, update sctpverifyinit() to validate parameter bounds using the actual embedded INIT length instead of chunk->chunkend, since the INIT stored in COOKIE-ECHO may not span the entire chunk buffer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-34.34~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1012.12~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-34.34.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-34.34 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1007.8 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1012.12 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1020.20 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-34.34.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-34.34.1 - Compensating control
Harden SCTP COOKIE-ECHO processing: when cookie_auth_enable is disabled, call sctp_verify_init() after cookie unpacking in sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook(), verify in sctp_unpack_cookie() that the embedded chunk type is SCTP_CID_INIT before treating it as an INIT chunk, and make sctp_verify_init() validate parameter bounds against the actual embedded INIT length rather than chunk->chunk_end. On verification failure, free the new association and discard the packet.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems processing SCTP COOKIE-ECHO packets are exposed when SCTP cookie authentication is disabled. The affected Ubuntu kernel package list includes linux, linux-fips, linux-aws, linux-azure, linux-aws-fips, linux-azure-fips, linux-gcp, and linux-gcp-fips.
What does an attacker need to exploit it?
An attacker needs network access to an SCTP endpoint that accepts the handshake traffic and has cookie authentication disabled. No privileges or user interaction are required according to the supplied severity vector.
What can be done if the updated kernel cannot be deployed immediately?
Enable SCTP cookie authentication where possible. With cookie authentication enabled, the cookie contents are protected against tampering; the vulnerability concerns reconstructed INIT data when that protection is disabled.
How can I determine whether a system is at risk?
Check whether the system runs one of the listed Ubuntu kernel packages and whether SCTP cookie authentication, represented by cookie_auth_enable, is disabled. Systems not handling SCTP COOKIE-ECHO traffic are not described as exposed by the provided information.