CVE-2026-53004

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks<br /> <br /> sctp_getsockopt_peer_auth_chunks() checks that the caller&amp;#39;s optval<br /> buffer is large enough for the peer AUTH chunk list with<br /> <br /> if (len gauth_chunks, which lives<br /> at offset offsetof(struct sctp_authchunks, gauth_chunks) == 8<br /> inside optval. The check is missing the sizeof(struct<br /> sctp_authchunks) = 8-byte header. When the caller supplies<br /> len == num_chunks (for any num_chunks &gt; 0) the test passes but<br /> copy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes<br /> past the declared buffer.<br /> <br /> The sibling function sctp_getsockopt_local_auth_chunks() at the<br /> next line already has the correct check:<br /> <br /> if (len