Critical severity9.8NVD Advisory· Published Jun 25, 2026· Updated Jul 7, 2026
CVE-2026-53246
CVE-2026-53246
Description
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().
However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).
Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.
Affected products
110- osv-coords97 versionspkg:apk/chainguard/linux-qemu-6.18pkg:rpm/almalinux/kernel-64k-develpkg:rpm/almalinux/kernel-64k-devel-matchedpkg:rpm/almalinux/kernel-64k-modules-extrapkg:rpm/almalinux/kernel-debug-devel-matchedpkg:rpm/almalinux/kernel-debug-modules-corepkg:rpm/almalinux/kernel-devel-matchedpkg:rpm/almalinux/kernel-rt-64kpkg:rpm/almalinux/kernel-rt-64k-corepkg:rpm/almalinux/kernel-rt-64k-debugpkg:rpm/almalinux/kernel-rt-64k-debug-corepkg:rpm/almalinux/kernel-rt-64k-debug-develpkg:rpm/almalinux/kernel-rt-64k-debug-modulespkg:rpm/almalinux/kernel-rt-64k-debug-modules-extrapkg:rpm/almalinux/kernel-rt-64k-modulespkg:rpm/almalinux/bpftoolpkg:rpm/almalinux/kernel-abi-stablelistspkg:rpm/almalinux/kernel-cross-headerspkg:rpm/almalinux/kernel-debug-corepkg:rpm/almalinux/kernel-debug-modules-extrapkg:rpm/almalinux/kernel-develpkg:rpm/almalinux/kernel-zfcpdump-modules-extrapkg:rpm/almalinux/kernel-64k-debug-modulespkg:rpm/opensuse/kernel-obs-qa&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/kernel-headerspkg:rpm/almalinux/kernel-toolspkg:rpm/almalinux/kernel-zfcpdump-modulespkg:rpm/almalinux/python3-perfpkg:rpm/almalinux/kernel-64k-debug-modules-corepkg:rpm/almalinux/kernel-rt-64k-modules-corepkg:rpm/almalinux/kernel-rt-64k-modules-extrapkg:rpm/almalinux/rtlapkg:rpm/almalinux/rvpkg:rpm/almalinux/kernel-modules-extra-matchedpkg:apk/chainguard/linux-gcp-6.18-bootc-boot-installedpkg:rpm/opensuse/kernel-azure&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-build&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/kernel-docpkg:rpm/almalinux/kernel-modulespkg:rpm/almalinux/kernel-modules-extrapkg:rpm/almalinux/kernel-tools-libs-develpkg:rpm/almalinux/kernel-zfcpdumppkg:rpm/almalinux/kernel-zfcpdump-corepkg:rpm/almalinux/perfpkg:rpm/almalinux/kernel-rt-debug-corepkg:rpm/almalinux/kernel-rt-debug-modulespkg:rpm/almalinux/kernel-debug-develpkg:rpm/opensuse/kernel-default-base&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/linux-gcp-6.18pkg:apk/chainguard/linux-vmware-6.18pkg:apk/chainguard/linux-azure-6.18pkg:apk/chainguard/linux-qemu-6.18-bootc-boot-installedpkg:rpm/almalinux/kernel-rt-debugpkg:rpm/almalinux/kernel-rt-modules-extrapkg:rpm/almalinux/kernel-64k-debug-develpkg:rpm/almalinux/kernel-64k-debug-modules-extrapkg:rpm/almalinux/kernel-64k-modulespkg:rpm/almalinux/kernel-64k-modules-corepkg:rpm/almalinux/kernel-debug-uki-virtpkg:rpm/almalinux/kernel-modules-corepkg:rpm/almalinux/kernel-rt-64k-develpkg:rpm/almalinux/kernel-uki-virtpkg:rpm/almalinux/libperfpkg:rpm/opensuse/kernel-docs&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/kernel-debugpkg:rpm/almalinux/kernel-64kpkg:rpm/almalinux/kernel-64k-debug-corepkg:rpm/almalinux/kernel-64k-debug-devel-matchedpkg:rpm/almalinux/kernel-rt-debug-modules-corepkg:rpm/almalinux/kernel-rt-modules-corepkg:rpm/almalinux/kernel-tools-libspkg:rpm/almalinux/kernel-rtpkg:rpm/almalinux/kernel-rt-corepkg:rpm/almalinux/kernel-rt-debug-develpkg:rpm/almalinux/kernel-rt-debug-modules-extrapkg:rpm/almalinux/kernel-rt-develpkg:rpm/almalinux/kernel-rt-modulespkg:linux/kernelpkg:rpm/almalinux/kernel-debug-modulespkg:rpm/almalinux/kernel-64k-debugpkg:rpm/almalinux/kernel-uki-virt-addonspkg:rpm/almalinux/kernel-zfcpdump-devel-matchedpkg:rpm/almalinux/kernel-zfcpdump-modules-corepkg:rpm/opensuse/dtb-aarch64&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-64kb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-default&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-kvmsmall&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-rt&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-syms&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-zfcpdump&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/kernelpkg:rpm/almalinux/kernel-zfcpdump-develpkg:apk/chainguard/linux-qemu-melangepkg:rpm/almalinux/kernel-corepkg:rpm/almalinux/kernel-64k-corepkg:rpm/almalinux/kernel-rt-64k-debug-modules-core
< 6.18.38-r0+ 96 more
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 6.12.0-211.55.1.el10_2
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.rt7.503.el8_10
- (no CPE)range: < 4.18.0-553.162.1.rt7.503.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 6.12.0-160000.37.1.160000.2.19
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 4.18.0-553.162.1.rt7.503.el8_10
- (no CPE)range: < 4.18.0-553.162.1.rt7.503.el8_10
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.rt7.503.el8_10
- (no CPE)range: < 4.18.0-553.162.1.rt7.503.el8_10
- (no CPE)range: < 4.18.0-553.162.1.rt7.503.el8_10
- (no CPE)range: < 4.18.0-553.162.1.rt7.503.el8_10
- (no CPE)range: < 4.18.0-553.162.1.rt7.503.el8_10
- (no CPE)range: < 4.18.0-553.162.1.rt7.503.el8_10
- (no CPE)range: >= 2.6.12, < 6.18.36
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 6.18.36-r0
- (no CPE)range: < 4.18.0-553.162.1.el8_10
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 12 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=2.6.12.1,<6.18.36
- cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*
- (no CPE)
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.