CVE-2026-53224

What it actually does

This is a Linux kernel SCTP parsing vulnerability in state-cookie handling. A malformed SCTP COOKIE_ECHO can contain an embedded INIT chunk that is shorter than the required INIT header, or an address-list length that extends beyond the actual cookie payload when cookie authentication is disabled. Subsequent SCTP processing can then read past the end of the received buffer while parsing INIT parameters or address parameters. The most likely technical outcomes are kernel out-of-bounds reads, kernel warnings or crashes, and denial of service. Depending on kernel build options, memory layout, and surrounding code paths, limited information disclosure cannot be fully ruled out, but the description primarily supports a stability/availability impact rather than direct remote code execution.

Why it matters to the business

Systems that expose SCTP services may be vulnerable to remote disruption from specially crafted SCTP traffic. If exploited successfully, affected Linux hosts could experience kernel crashes, service interruption, failover events, or degraded availability for applications that rely on SCTP, such as telecom, signaling, control-plane, or specialized network services. The current EPSS score is low and the issue is not listed in CISA KEV, so broad active exploitation is not indicated, but internet- or partner-exposed SCTP endpoints should still be prioritized because exploitation can be remote and may not require authentication at the application layer.

How an attack unfolds

An attacker first identifies a Linux system that accepts SCTP traffic. The attacker initiates or simulates SCTP association setup far enough to send a COOKIE_ECHO message. Instead of sending a well-formed cookie, the attacker embeds malformed state-cookie contents: a truncated INIT chunk, an oversized raw address-list length, or malformed address parameters with inconsistent header and payload lengths. Vulnerable kernel SCTP code accepts insufficiently validated length fields and later parses the embedded INIT or address list as if complete data were present. This can cause the kernel to read beyond the cookie buffer, potentially triggering a kernel fault, warning, or crash. Exploitation is most relevant where SCTP is enabled and reachable, and the address-list path is specifically relevant when SCTP cookie authentication is disabled.

How to fix it

Upgrade to a Linux kernel version that includes the SCTP fix validating embedded INIT chunk size, combined INIT/address-list bounds, and address-parameter header and payload lengths. Because no product-specific fixed versions were provided, use the relevant Linux distribution security advisory, vendor kernel errata, or upstream stable kernel release that backports the fix for CVE-2026-53224. Where immediate patching is not possible, reduce exposure by disabling SCTP if it is not required, blocking SCTP at network boundaries and host firewalls, restricting SCTP access to trusted peers, and enabling SCTP cookie authentication where operationally feasible. Mitigations should not be treated as a substitute for patching on systems that must accept SCTP traffic.

How to confirm the fix worked

Confirm that the running kernel package or build includes the vendor fix for this vulnerability, not only that an updated package is installed. Validate with the distribution advisory, kernel changelog, package version, or commit reference showing the SCTP cookie length-validation fix. Check whether SCTP is enabled or loaded by reviewing loaded modules, kernel configuration, listening services, firewall policy, and observed SCTP traffic. After remediation, test that SCTP exposure is limited to expected interfaces and peers. If safe in a controlled test environment, malformed SCTP COOKIE_ECHO traffic should be rejected without kernel warnings, oops messages, service crashes, or host instability.

Typical attack path

1. Discover a host or service with SCTP reachable over the network.
2. Confirm the target responds to SCTP association setup traffic.
3. Craft an SCTP COOKIE_ECHO containing a malformed state cookie with a truncated embedded INIT chunk or inconsistent address-list lengths.
4. Send the malformed COOKIE_ECHO to the target SCTP endpoint.
5. Trigger vulnerable kernel parsing in sctp_unpack_cookie(), sctp_process_init(), or sctp_raw_to_bind_addrs().
6. Cause out-of-bounds kernel reads that may result in denial of service, kernel oops, panic, or service instability.

How to detect it

Look for evidence of attempted or successful exploitation in network telemetry, kernel logs, crash dumps, and endpoint monitoring. Network sources include packet captures, IDS/IPS sensors, NetFlow/IPFIX with protocol visibility, firewall logs that record SCTP, and telecom/security gateways that decode SCTP chunks. Focus on unexpected SCTP traffic, especially COOKIE_ECHO chunks from untrusted sources, repeated SCTP association attempts, malformed SCTP packets, or spikes in SCTP errors before a crash. Host sources include dmesg, journalctl, /var/log/kern.log, /var/log/messages, crash dump directories, kdump/vmcore artifacts, KASAN/UBSAN reports, and monitoring alerts for kernel oops or panic. Useful artifacts include stack traces referencing sctp_unpack_cookie(), sctp_process_init(), sctp_raw_to_bind_addrs(), or SCTP address parsing immediately before host instability. Because exploitation may only cause an out-of-bounds read and crash, there may be no persistent file artifact; absence of logs does not prove absence of attempted exploitation if kernel logs rotated or the host rebooted abruptly.

• sctp_unpack_cookie
• sctp_process_init
• sctp_raw_to_bind_addrs
• COOKIE_ECHO
• SCTP COOKIE_ECHO
• kernel BUG
• kernel panic
• Oops:
• BUG: KASAN: out-of-bounds
• KASAN: slab-out-of-bounds
• KASAN: global-out-of-bounds
• UBSAN: array-index-out-of-bounds
• general protection fault
• Call Trace:
• /var/log/kern.log
• /var/log/messages
• /var/crash/
• /var/lib/systemd/coredump/
• /proc/net/sctp/assocs
• /proc/net/sctp/eps

What your security team should do

• Identify Linux systems with SCTP enabled, the sctp kernel module loaded, or SCTP traffic allowed through perimeter, cloud, host, or appliance firewalls.
• Prioritize patching internet-facing, partner-facing, telecom, signaling, and high-availability systems that accept SCTP.
• Apply the vendor-provided kernel update or upstream stable kernel containing the SCTP cookie validation fix, then reboot into the fixed kernel where required.
• Disable SCTP entirely on systems that do not need it, or block SCTP protocol traffic at network and host firewalls.
• Restrict SCTP access to known trusted peers and management networks until all affected systems are patched.
• Review kernel logs and crash telemetry for SCTP-related oops, panic, KASAN, UBSAN, or out-of-bounds read messages since publication.
• Add network monitoring for malformed SCTP COOKIE_ECHO traffic where sensors support SCTP parsing.
• Track vendor advisories because the description notes an additional sequencing concern when cookie authentication is disabled that is addressed separately.