CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: validate cookie AUTH state before use<br /> <br /> When cookie authentication is disabled, COOKIE_ECHO restores fixed-size<br /> AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM<br /> length, HMAC list, or CHUNKS list can then reach association consumers<br /> with lengths or identifiers that were never validated against the local<br /> backing arrays.<br /> <br /> A forged RANDOM length can cause out-of-bounds reads during key-vector<br /> construction. A forged HMAC identifier also caused a 32-byte write past<br /> a zero-length AUTH chunk, providing a primitive for a local privilege<br /> escalation chain.<br /> <br /> Validate the cookie&amp;#39;s RANDOM, HMACS, and CHUNKS parameters at the cookie<br /> trust boundary before copying them into the association. Reject invalid<br /> types, malformed lengths, unsupported HMAC identifiers, HMAC lists<br /> without SHA1, and forbidden chunk ids.