CVE-2026-64551 sctp: validate STALE_COOKIE cause length before reading staleness
An attacker can leak uninitialized kernel memory by sending a malformed SCTP ERROR chunk, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64551?
CVE-2026-64551 is a critical vulnerability in Linux, published on 27 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate STALE_COOKIE cause length before reading staleness
When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure of Staleness that follows the cause header:
err = (struct sctp_errhdr *)(chunk->skb->data); stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
err is the first cause in the chunk, not the STALE_COOKIE cause that caused the dispatch, and nothing guarantees the staleness field is present. sctp_walk_errors() only requires a cause to be as long as the 4-byte header, so for a STALE_COOKIE cause of length 4 the read runs past the cause, and for a minimal ERROR chunk past skb->tail. The value is echoed to the peer in the Cookie Preservative of the reply INIT, leaking uninitialized memory.
sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so check its length there and pass it to sctp_sf_do_5_2_6_stale(), which reads that cause instead of the first one. A STALE_COOKIE cause too short to hold the staleness field is discarded.
The read is reachable by any peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace.
Weakness: CWE-125
Which versions are affected by CVE-2026-64551?
How do I fix CVE-2026-64551?
Apply the vendor's patch.
Is CVE-2026-64551 being exploited?
There is no known exploitation of CVE-2026-64551 in the wild and no public exploit code.
Sources
Also known as AZL-94031, BELL-CVE-2026-64551, DEBIAN-CVE-2026-64551, GHSA-m58p-8fjh-3whj, OESA-2026-3986, ROOT-OS-DEBIAN-12-CVE-2026-64551 and 1 more.