CVE-2026-53246

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-53246

Key Details

CVE	CVE-2026-53246
CVSS Score / Version	9.8 (Critical) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Classified as	CWE-787 (Out-of-bounds Write)

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

When a listening SCTP server processes a COOKIE_ECHO chunk, the cached

peer INIT chunk embedded after the cookie is parsed and its parameters

are later walked by sctp_process_init() using sctp_walk_params().

However, the chunk header length of this cached INIT chunk was not

validated against the remaining buffer in the COOKIE_ECHO payload. If

the length field is inflated, the parameter walk can run beyond the

actual received data, leading to out-of-bounds reads and potential

memory corruption during later parameter handling (e.g. STATE_COOKIE

processing and kmemdup() copies).

Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT

chunk length does not exceed the available data in the COOKIE_ECHO

buffer before it is used. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-53246
CVE	https://www.cve.org/CVERecord?id=CVE-2026-53246

Source

Reference

NVD

CVE