CVE-2026-53246

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing<br /> <br /> When a listening SCTP server processes a COOKIE_ECHO chunk, the cached<br /> peer INIT chunk embedded after the cookie is parsed and its parameters<br /> are later walked by sctp_process_init() using sctp_walk_params().<br /> <br /> However, the chunk header length of this cached INIT chunk was not<br /> validated against the remaining buffer in the COOKIE_ECHO payload. If<br /> the length field is inflated, the parameter walk can run beyond the<br /> actual received data, leading to out-of-bounds reads and potential<br /> memory corruption during later parameter handling (e.g. STATE_COOKIE<br /> processing and kmemdup() copies).<br /> <br /> Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT<br /> chunk length does not exceed the available data in the COOKIE_ECHO<br /> buffer before it is used.