CVE-2026-53225 sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
An unauthenticated SCTP peer can trigger a read of uninitialized memory in the Linux kernel, potentially disclosing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53225?
CVE-2026-53225 is a critical vulnerability in Linux kernel, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
__sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.
An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.
Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.
The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop").
Which versions are affected by CVE-2026-53225?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53225?
Apply the vendor's patch.
Is CVE-2026-53225 being exploited?
There is no known exploitation of CVE-2026-53225 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90732, BELL-CVE-2026-53225, DEBIAN-CVE-2026-53225, GHSA-fj73-9fr6-g7mw, ROOT-OS-DEBIAN-11-CVE-2026-53225, ROOT-OS-DEBIAN-12-CVE-2026-53225 and 3 more.