CVE-2026-53246

What it actually does

This flaw is a Linux kernel memory-safety bug in SCTP COOKIE_ECHO handling. A listening SCTP endpoint parses a peer INIT chunk embedded in the COOKIE_ECHO payload, but vulnerable kernels do not sufficiently validate that the cached INIT chunk length fits within the remaining COOKIE_ECHO buffer. A malformed packet can cause the kernel to walk SCTP parameters beyond the actual received data, resulting in out-of-bounds reads and possible memory corruption during later parameter processing. Practical outcomes may include kernel instability, denial of service, or potentially more severe memory-corruption effects depending on kernel build, SCTP configuration, and reachable code paths.

Why it matters to the business

Systems that expose SCTP services can be remotely destabilized by specially crafted network traffic, potentially causing service interruption, node crashes, or degraded availability for applications that depend on SCTP. The currently reported EPSS is low and it is not listed in CISA KEV, with no known mature public exploitation indicated, but internet- or untrusted-network-exposed SCTP listeners should still be prioritized because kernel-level bugs can have high operational impact.

How an attack unfolds

An attacker first identifies a host that accepts SCTP associations, typically a server with an SCTP listener reachable over the network. The attacker initiates or continues the SCTP handshake until the target processes a COOKIE_ECHO chunk. They then send a crafted COOKIE_ECHO payload containing an embedded cached INIT chunk whose length field claims more data than is actually present in the received buffer. On a vulnerable kernel, SCTP cookie unpacking accepts this inconsistent length and later parameter parsing walks past the valid buffer boundary. This can trigger out-of-bounds reads and potentially memory corruption during parameter handling, which may crash the kernel or SCTP service path. There are no named threat actors or ransomware campaigns currently associated with this issue in the provided intelligence.

How to fix it

Upgrade the Linux kernel to a version that includes the SCTP fix validating the cached peer INIT chunk length in sctp_unpack_cookie() before parameter processing. If distribution-specific fixed package versions are not yet available, apply the vendor kernel update as soon as it is released or backport the upstream patch that adds the bounds check. As temporary mitigations, disable SCTP if it is not required, unload or block the SCTP kernel module where operationally safe, restrict SCTP traffic to trusted peers using host and network firewalls, and remove public exposure of SCTP listeners. Because no exact affected product list or fixed package versions were provided, remediation should follow the relevant Linux distribution security advisory for this CVE and kernel branch.

How to confirm the fix worked

Confirm the running kernel includes the SCTP COOKIE_ECHO cached INIT length validation fix by checking the installed distribution kernel changelog, package advisory, or source patch history for the sctp_unpack_cookie() bounds check. Verify whether SCTP is enabled or loaded by checking kernel modules, protocol support, and listening SCTP sockets. Confirm network controls block unsolicited SCTP traffic from untrusted sources. Where safe and authorized, use a non-destructive SCTP test or packet-capture review to confirm that malformed COOKIE_ECHO traffic is rejected rather than causing kernel warnings, oops messages, or crashes. Validate that all hosts have rebooted into the patched kernel after package installation.

Typical attack path

1. Discover a host with SCTP enabled and a listening SCTP service reachable from the attacker-controlled network path.
2. Send SCTP handshake traffic sufficient to reach COOKIE_ECHO processing on the target.
3. Craft a COOKIE_ECHO chunk containing an embedded cached INIT chunk with an inflated chunk length field.
4. Cause the vulnerable kernel to parse the cached INIT parameters beyond the actual COOKIE_ECHO payload boundary.
5. Trigger kernel memory-safety failure conditions such as out-of-bounds reads, memory corruption, warning/oops events, or service-impacting crashes.

How to detect it

Retrospective detection should focus on exposed SCTP services, kernel crash evidence, and anomalous SCTP handshake traffic. Review system logs such as dmesg, journald, /var/log/kern.log, /var/log/messages, crash dumps, and kernel oops/panic records for SCTP-related errors around the time of unexpected reboots or service loss. Review network telemetry, packet captures, Zeek-like protocol logs if SCTP-aware, firewall logs, and IDS events for inbound SCTP traffic containing COOKIE_ECHO chunks from untrusted sources, especially malformed packets where the embedded INIT chunk length exceeds the remaining COOKIE_ECHO payload. Because exploitation may only leave evidence of a kernel fault or reboot, absence of application logs does not rule out attempted exploitation. If crash dumps are available, inspect kernel stack traces for SCTP cookie or INIT processing functions such as sctp_unpack_cookie, sctp_process_init, sctp_walk_params, STATE_COOKIE handling, and kmemdup-related failures.

• sctp_unpack_cookie
• sctp_process_init
• sctp_walk_params
• COOKIE_ECHO
• STATE_COOKIE
• SCTP:
• kernel: SCTP
• BUG: kernel NULL pointer dereference
• BUG: unable to handle kernel paging request
• general protection fault
• kernel panic
• Oops:
• Call Trace:
• kmemdup

What your security team should do

• Inventory Linux systems that have SCTP enabled, the SCTP module loaded, or SCTP services listening on untrusted networks.
• Prioritize patching externally reachable SCTP servers and high-availability infrastructure running vulnerable Linux kernels.
• If patching is delayed, restrict SCTP at perimeter, host, and security-group firewalls to known trusted peers only, or disable SCTP where not required.
• Monitor kernel logs for SCTP-related warnings, oops messages, panics, and crashes, especially following inbound SCTP COOKIE_ECHO traffic.
• Capture and retain SCTP network telemetry for exposed services to support retrospective analysis of malformed COOKIE_ECHO attempts.
• Track vendor advisories for exact fixed kernel package versions and ensure systems are rebooted into the corrected kernel.