{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-72398 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-72398 is a critical missing authorization vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-72398 and fix it if it is affected.\n\nWhat it is: CVE-2026-72398 is a critical missing authorization vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-72398 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-72398/ (Markdown: https://insights.sbomify.com/CVE-2026-72398/index.md)","id":"CVE-2026-72398","markdown":"https://insights.sbomify.com/CVE-2026-72398/index.md","name":"CVE-2026-72398","record":{"aliases":["AZL-96171","BELL-CVE-2026-72398","DEBIAN-CVE-2026-72398","GHSA-59hc-5687-r27h","UBUNTU-CVE-2026-72398"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Linux kernel SCTP","requires_auth":"none","summary":"Attackers can bypass SCTP INIT verification when cookie authentication is disabled, potentially leading to code execution or denial of service.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: add INIT verification after cookie unpacking\n\nIn SCTP handshake, the INIT chunk is initially processed by the server\nand embedded into the cookie carried in INIT-ACK. The client then\nreturns this cookie via COOKIE-ECHO, where the server unpacks it and\nreconstructs the original INIT chunk.\n\nWhen cookie authentication is enabled, the cookie contents are protected\nagainst tampering, so reusing the unpacked INIT without re-verification\nis safe.\n\nHowever, when cookie authentication is disabled, the reconstructed INIT\ncan no longer be trusted. In this case, the INIT must be explicitly\nvalidated after unpacking to avoid processing potentially tampered data.\n\nAdd sctp_verify_init() checks after cookie unpacking in COOKIE-ECHO\nprocessing paths (sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook())\nwhen cookie_auth_enable is disabled. On failure, the new association is\nfreed and the packet is discarded.\n\nAlso tighten cookie validation in sctp_unpack_cookie() by verifying the\nembedded chunk type is SCTP_CID_INIT before treating it as an INIT\nchunk.\n\nFinally, update sctp_verify_init() to validate parameter bounds using\nthe actual embedded INIT length instead of chunk-\u003echunk_end, since the\nINIT stored in COOKIE-ECHO may not span the entire chunk buffer.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"sctp: add INIT verification after cookie unpacking","id":"CVE-2026-72398","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"net: enetc: check the number of BDs needed for xdp_frame","id":"CVE-2026-72399"},"packages":[],"prev":{"headline":"hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()","id":"CVE-2026-72397"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"Attackers can bypass SCTP INIT verification when cookie authentication is disabled, potentially leading to code execution or denial of service.","url":"https://insights.sbomify.com/CVE-2026-72398/"}