CVE-2026-53004

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks sctp_getsockopt_peer_auth_chunks() checks that the caller's optval buffer is large enough for the peer AUTH chunk list with if (len < num_chunks) return -EINVAL; but then writes num_chunks bytes to p->gauth_chunks, which lives at offset offsetof(struct sctp_authchunks, gauth_chunks) == 8 inside optval. The check is missing the sizeof(struct sctp_authchunks) = 8-byte header. When the caller supplies len == num_chunks (for any num_chunks > 0) the test passes...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 65b07e5d0d09c77e98050b5f0146ead29e5add32 < a132e199de69e2a45628aa8534df1bf5d44e1b6e, >= 65b07e5d0d09c77e98050b5f0146ead29e5add32 < 2b5a2c957c7769d40110f725cf23987fcef50d75, >= 65b07e5d0d09c77e98050b5f0146ead29e5add32 < d45c7e99caf915b0f6c716bd8ffe9d45b9685761, >= 65b07e5d0d09c77e98050b5f0146ead29e5add32 < d67fbc6dea5dbf7f46c618ebf65910a276078e20, >= 65b07e5d0d09c77e98050b5f0146ead29e5add32 < 6849b995cda88a677bf08a05765d1db7905974fc, >= 65b07e5d0d09c77e98050b5f0146ead29e5add32 < 70a089cc9590aa347a61e84434116ab74619e3c3, >= 65b07e5d0d09c77e98050b5f0146ead29e5add32 < 6bcf8fe4ef7967b22b814cbae9a57bbd3c853410, >= 65b07e5d0d09c77e98050b5f0146ead29e5add32 < 0cf004ffb61cd32d140531c3a84afe975f9fc7ea, >= 2.6.24, >= 2.6.24 < 5.10.258, >= 5.11 < 5.15.209, >= 5.16 < 6.1.175, >= 6.2 < 6.6.141, >= 6.7 < 6.12.91, >= 6.13 < 6.18.33, >= 6.19 < 7.0.10

Fixed versions

5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787