# CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup()

> An unauthenticated SCTP peer can trigger a read of uninitialized memory in the Linux kernel, potentially disclosing sensitive data.

- **Severity:** Critical 9.1 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 25 Jun 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-90732, BELL-CVE-2026-53225, DEBIAN-CVE-2026-53225, GHSA-fj73-9fr6-g7mw, ROOT-OS-DEBIAN-11-CVE-2026-53225, ROOT-OS-DEBIAN-12-CVE-2026-53225, ROOT-OS-UBUNTU-2204-CVE-2026-53225, ROOT-OS-UBUNTU-2404-CVE-2026-53225, UBUNTU-CVE-2026-53225

## What is CVE-2026-53225?

CVE-2026-53225 is a critical vulnerability in Linux kernel, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix uninit-value in __sctp_rcv_asconf_lookup()

__sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF
chunk can hold the ADDIP header and a parameter header, then calls
af->from_addr_param(), which reads the full address (16 bytes for IPv6)
trusting the parameter's declared length.

An unauthenticated peer can send a truncated trailing ASCONF chunk that
declares an IPv6 address parameter but stops after the 4-byte parameter
header; reached from the no-association lookup path, from_addr_param() then
reads uninitialized bytes past the parameter.

Impact: an unauthenticated SCTP peer makes the receive path read up to 16
bytes of uninitialized memory past a truncated ASCONF address parameter.

The sibling __sctp_rcv_init_lookup() bounds parameters with
sctp_walk_params(); this path open-codes the fetch and omits the bound.
Verify the whole address parameter lies within the chunk before
from_addr_param() reads it, the same class of fix as commit 51e5ad549c43
("net: sctp: fix KMSAN uninit-value in sctp_inq_pop").

Weakness: CWE-908 (Use of Uninitialized Resource), CWE-125 (Out-of-bounds Read)

## Which versions are affected by CVE-2026-53225?

It affects 1 product.


Products: Linux kernel.

## How do I fix CVE-2026-53225?

Apply the vendor's patch.

## Is CVE-2026-53225 being exploited?

There is no known exploitation of CVE-2026-53225 in the wild and no public exploit code.

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-53225 and fix it if it is affected.

What it is: CVE-2026-53225 is a critical vulnerability in Linux kernel, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-53225 in the wild and no public exploit code.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-53225/ (Markdown: https://insights.sbomify.com/CVE-2026-53225/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-53225
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53225
- OSV: https://osv.dev/vulnerability/CVE-2026-53225

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-53225/
Summaries are generated and may contain mistakes; the official description above is the record.