CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

Synopsis

An out-of-bounds read and potential memory corruption vulnerability exists in the Linux kernel's SCTP subsystem, specifically in how a listening server processes COOKIE_ECHO chunks. The flaw is reachable over the network with no authentication or user interaction required, as derived from the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation allows a remote attacker to read memory beyond intended boundaries and corrupt kernel memory, enabling full confidentiality loss, data tampering, and service disruption. Patched-image rebuilds at fix versions 6.18.36, 7.0.13, and 7.1 are available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target's SCTP listener over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials or session tokens are needed; the malformed COOKIE_ECHO chunk can be sent by any unauthenticated remote peer.

• Victim interactionNot required

  The vulnerable code path is triggered by a network packet alone; no action by a logged-in user or administrator is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker reads kernel memory contents beyond the intended SCTP buffer boundary, which can expose sensitive in-kernel data such as cryptographic material, session state, or adjacent heap contents.
• The out-of-bounds access during parameter handling and kmemdup copies allows an attacker to corrupt kernel memory, opening a path to arbitrary code execution at the kernel level.
• An attacker can crash the affected host by triggering memory corruption that destabilizes kernel data structures, causing a kernel panic and taking down all workloads on that node.
• Any data processed by or stored in the affected kernel, including container workloads sharing that host, is at risk of unauthorized read or modification.