Intel

CVE-2026-53224

Security update for the Linux Kernel

criticalEPSS 0.5%

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate embedded INIT chunk and address list lengths in cookie

sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.

A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.

In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.

Fix this by:

  • requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk);
  • validating that the INIT chunk and raw address list together fit within the cookie payload;
  • verifying sufficient data exists for each address parameter header and payload before parsing it.

Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.

Source: SUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFUBUNTU_USNUBUNTU_USNUBUNTU_USNSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNBSIBSI_CSAFUBUNTU_USNSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFSUSE_CSAFUBUNTU_USNCVELISTV5CVEORGNVD

Metrics

Severity
critical
Priority score
238.98
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
9.1
Source: nvd-v3
CVSS v3
9.1
CVSS v4
—
EPSS percentile
42.4 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
0.5 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-09-09 12:14 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-07-02 20:46 UTC· nvd@nist.gov
    • CWE: CWE-125
    • CPE Configuration: OR *cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.12.1 up to (excluding) 6.18.36
    • Reference Type: kernel.org: https://git.kernel.org/stable/c/512a9bb77c04ac9927648ea58af617e472be96e6 Types: Patch
    • Reference Type: kernel.org: https://git.kernel.org/stable/c/6f4c80a2a7e6d06753b89a578b710a2499a5e62b Types: Patch

Affected operating systems

  • linux

    amazon / amazon_linux

  • linux

    suse / basesystem_module15

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    debian / debian_linux13.0

  • linux

    suse / development_tools_module15

  • linux

    redhat / enterprise_linux10.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • linux

    redhat / enterprise_linux_aus8.4

  • linux

    redhat / enterprise_linux_aus8.6

  • linux

    redhat / enterprise_linux_eus10.0

  • linux

    redhat / enterprise_linux_eus8.4

  • linux

    redhat / enterprise_linux_eus9.4

  • linux

    redhat / enterprise_linux_eus9.6

  • linux

    redhat / enterprise_linux_tus8.6

  • linux

    redhat / enterprise_linux_tus8.8

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions8.6

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions8.8

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions9.0

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions9.2

  • linux

    opensuse / leap15.3

  • linux

    opensuse / leap15.4

  • linux

    opensuse / leap15.5

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • AMD

    ProzessorEPYC Series

  • AMD

    ProzessorRyzen

  • arista

    cloudvision_agni2024.4.0 – 2025.2.2

  • arista

    cloudvision_portal2024.2.0 – 2026.1.0

  • arista

    velocloud_edge4.5.0 – 6.4.1

  • arista

    velocloud_gateway

  • arista

    velocloud_orchestrator

  • Dell

    NetWorkerVirtual Edition

  • Dell

    PowerProtect Data Domain7.10.1.70

  • Dell

    PowerProtect Data Domain7.13.1.40

  • Dell

    PowerProtect Data Domain8.3.1.10

  • Dell

    PowerProtect Data Domain8.4.0.0

  • IBM

    QRadar SIEM7.5.0 UP10 IF01

  • IBM

    QRadar SIEM7.5.0 UP11

  • IBM

    QRadar SIEM<7.5.0 UP15 IF06

  • IBM

    Security Guardium12

  • IBM

    Storage Scale6.1.9.5

  • IBM

    Storage Scale6.2.2.0

  • Juniper

    Junos Space24.1R2

  • Oracle

    VM3

  • redhat

    openshift_container_platform4.12 – 4.12.89

  • redhat

    openshift_container_platform4.13 – 4.13.66

  • redhat

    openshift_container_platform4.14 – 4.14.65

  • redhat

    openshift_container_platform4.15 – 4.15.64

References & sources

Linked CVEs

Show 51 more CVEs
IDCVE-2026-53224