PT-2026-51898 · Linux · Linux
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-53004
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix OOB write to userspace in sctp getsockopt peer auth chunks
sctp getsockopt peer auth chunks() checks that the caller's optval
buffer is large enough for the peer AUTH chunk list with
if (len < num chunks)
return -EINVAL;
but then writes num chunks bytes to p->gauth chunks, which lives
at offset offsetof(struct sctp authchunks, gauth chunks) == 8
inside optval. The check is missing the sizeof(struct
sctp authchunks) = 8-byte header. When the caller supplies
len == num chunks (for any num chunks > 0) the test passes but
copy to user() writes sizeof(struct sctp authchunks) = 8 bytes
past the declared buffer.
The sibling function sctp getsockopt local auth chunks() at the
next line already has the correct check:
if (len < sizeof(struct sctp authchunks) + num chunks)
return -EINVAL;
Align the peer variant with its sibling.
Reproducer confirms on v7.0-13-generic: an unprivileged userspace
caller that opens a loopback SCTP association with AUTH enabled,
queries num chunks with a short optval, then issues the real
getsockopt with len == num chunks and sentinel bytes painted past
the buffer observes those sentinel bytes overwritten with the
peer's AUTH chunk type. The bytes written are under the peer's
control but land in the caller's own userspace; this is not a
kernel memory corruption, but it is a kernel-side contract
violation that can silently corrupt adjacent userspace data.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux