CVE-2026-53224 sctp: validate embedded INIT chunk and address list lengths in cookie
A remote attacker can trigger out-of-bounds reads in the Linux kernel SCTP implementation by sending malformed COOKIE_ECHO chunks, potentially causing crashes or leaking memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53224?
CVE-2026-53224 is a critical memory corruption vulnerability in Linux kernel, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate embedded INIT chunk and address list lengths in cookie
sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.
A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.
In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.
Fix this by:
- requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it.
Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.
Weakness: CWE-125
Which versions are affected by CVE-2026-53224?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53224?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53224 being exploited?
There is no known exploitation of CVE-2026-53224 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90522, BELL-CVE-2026-53224, DEBIAN-CVE-2026-53224, GHSA-h634-6f45-j5wj, ROOT-OS-DEBIAN-11-CVE-2026-53224, ROOT-OS-DEBIAN-12-CVE-2026-53224 and 4 more.