PT-2026-65226 · Linux · Linux
CVE-2026-64551
·
Published
2026-07-27
·
Updated
2026-07-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate STALE COOKIE cause length before reading staleness
When an ERROR chunk with a STALE COOKIE cause is received in the
COOKIE ECHOED state, sctp sf do 5 2 6 stale() reads the 4-byte Measure
of Staleness that follows the cause header:
err = (struct sctp errhdr *)(chunk->skb->data);
stale = ntohl(*( be32 *)((u8 *)err + sizeof(*err)));err is the first cause in the chunk, not the STALE COOKIE cause that
caused the dispatch, and nothing guarantees the staleness field is
present. sctp walk errors() only requires a cause to be as long as the
4-byte header, so for a STALE COOKIE cause of length 4 the read runs
past the cause, and for a minimal ERROR chunk past skb->tail. The value
is echoed to the peer in the Cookie Preservative of the reply INIT,
leaking uninitialized memory.
sctp sf cookie echoed err() already walks to the STALE COOKIE cause, so
check its length there and pass it to sctp sf do 5 2 6 stale(), which
reads that cause instead of the first one. A STALE COOKIE cause too
short to hold the staleness field is discarded.
The read is reachable by any peer that can drive an association into
COOKIE ECHOED, including an unprivileged process using a raw SCTP socket
in a user and network namespace.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux