CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie

Synopsis

This is an out-of-bounds read vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. A remote attacker with no authentication can send a malformed COOKIE_ECHO packet containing a truncated INIT chunk or an oversized address list length, triggering reads beyond the bounds of the cookie payload buffer. Successful exploitation exposes sensitive kernel memory contents and can crash the affected system. Patched-image rebuilds at fix versions 6.18.36 and 7.0.13 (and the corresponding commit SHAs for other stable branches) are available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target's SCTP service over the network; no prior presence on the host is needed.

• AuthenticationNot required

  No credentials or account are required; the malformed packet can be sent by any unauthenticated network peer.

• Victim interactionNot required

  No user action is required; the vulnerability is triggered entirely by the attacker sending a crafted packet.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions, memory layout guessing, or special environmental state is required.

Blast Radius

• Reads arbitrary kernel memory contents from the SCTP cookie buffer region, which may include sensitive data from other kernel structures or processes.
• Crashes the affected kernel (denial of service) by triggering an out-of-bounds memory access during SCTP cookie processing, taking down any workloads running on that host.
• On container hosts, a kernel crash affects all containers sharing that kernel, not just the one processing SCTP traffic.
• Where cookie authentication is disabled, the address-list parser can be driven to read significantly beyond the cookie boundary, widening the window of exposed memory.