CVE-2026-53246 sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
An attacker can trigger out-of-bounds reads and memory corruption in the Linux kernel SCTP implementation by sending a malformed COOKIE_ECHO chunk.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53246?
CVE-2026-53246 is a critical memory corruption vulnerability in Linux kernel, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().
However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).
Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.
Which versions are affected by CVE-2026-53246?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53246?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53246 being exploited?
There is no known exploitation of CVE-2026-53246 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90624, BELL-CVE-2026-53246, DEBIAN-CVE-2026-53246, GHSA-48jv-x8c6-486c, ROOT-OS-DEBIAN-11-CVE-2026-53246, ROOT-OS-DEBIAN-12-CVE-2026-53246 and 4 more.