CVE-2026-53225

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: fix uninit-value in __sctp_rcv_asconf_lookup()<br /> <br /> __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF<br /> chunk can hold the ADDIP header and a parameter header, then calls<br /> af-&gt;from_addr_param(), which reads the full address (16 bytes for IPv6)<br /> trusting the parameter&amp;#39;s declared length.<br /> <br /> An unauthenticated peer can send a truncated trailing ASCONF chunk that<br /> declares an IPv6 address parameter but stops after the 4-byte parameter<br /> header; reached from the no-association lookup path, from_addr_param() then<br /> reads uninitialized bytes past the parameter.<br /> <br /> Impact: an unauthenticated SCTP peer makes the receive path read up to 16<br /> bytes of uninitialized memory past a truncated ASCONF address parameter.<br /> <br /> The sibling __sctp_rcv_init_lookup() bounds parameters with<br /> sctp_walk_params(); this path open-codes the fetch and omits the bound.<br /> Verify the whole address parameter lies within the chunk before<br /> from_addr_param() reads it, the same class of fix as commit 51e5ad549c43<br /> ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop").