CVE-2026-53004: Linux SCTP Out-of-Bounds Write in Userspace Memory

Technical summary

The vulnerability exists in sctp_getsockopt_peer_auth_chunks(), which retrieves a list of authentication chunks supported by a peer in an SCTP association. The function validates the caller's optval buffer size using 'if (len < num_chunks)' but neglects to account for the 8-byte sctp_authchunks header structure that precedes the actual chunk list data. When copy_to_user() executes, it writes the 8-byte header plus num_chunks bytes, resulting in an out-of-bounds write of 8 bytes past the declared buffer boundary. The sibling function sctp_getsockopt_local_auth_chunks() performs the correct validation: 'if (len < sizeof(struct sctp_authchunks) + num_chunks)', establishing the intended behavior. The fix aligns the peer variant with this correct boundary check.

Business impact

Local attackers can silently corrupt application memory without triggering crashes or obvious security alerts. This enables subtle data corruption attacks where an attacker with local access can manipulate SCTP authentication data to corrupt adjacent buffers in unprivileged user applications. In multi-tenant or containerized environments, this could allow one user to degrade or exploit the reliability of another user's applications. The subtle nature of the corruption—no kernel panic, no obvious error—increases the risk that such attacks go undetected during normal monitoring.

Affected systems

Any Linux system running the kernel with SCTP protocol support enabled and containing the vulnerable sctp_getsockopt_peer_auth_chunks() function. Affected are Linux kernel versions prior to the patch. The vulnerability requires local system access and an active SCTP association with AUTH enabled to trigger, limiting exposure to systems that actively use SCTP for inter-process or network communication.

Exploitability

Exploitation requires local user access to the system and the ability to create an SCTP socket with authentication enabled (typically over loopback). The attacker must query peer authentication chunks with a carefully crafted buffer size equal to num_chunks, allowing the kernel to write 8 extra bytes into the caller's userspace. The attack is deterministic and does not require privilege escalation, making it accessible to any local unprivileged user on a system with SCTP enabled. No network interaction or special capabilities are needed once local access is obtained.

Remediation

Apply the kernel patch that corrects the boundary validation in sctp_getsockopt_peer_auth_chunks() to match the check used in sctp_getsockopt_local_auth_chunks(): verify that len >= sizeof(struct sctp_authchunks) + num_chunks before proceeding. Verify against the vendor advisory for the specific patched kernel version applicable to your distribution and architecture.

Patch guidance

Monitor your Linux distribution's security advisories for a patched kernel version addressing CVE-2026-53004. The fix is a small validation logic change and should be available as a routine kernel update. Test the patched kernel in a staging environment to ensure SCTP functionality remains intact, particularly for applications relying on SCTP authentication. Prioritize deployment for systems actively using SCTP with AUTH enabled, or for multi-tenant environments where lateral user attacks are a concern.

Detection guidance

Monitor system logs for unusual SCTP getsockopt() calls with suspiciously small buffer sizes relative to returned chunk lists. Userspace application crashes or data corruption in memory adjacent to SCTP option buffers may indicate exploitation attempts. However, detection is challenging because the vulnerability causes silent data corruption without kernel errors. Behavioral monitoring of applications using SCTP auth features and inspection of local user activity on systems with SCTP enabled may help identify attack patterns. Consider disabling SCTP protocol support on systems that do not require it.

Why prioritize this

Although this is a local-only vulnerability requiring pre-existing system access, the HIGH CVSS score (7.8) reflects the complete compromise of confidentiality, integrity, and availability within the affected process context. The silent nature of the corruption makes it particularly insidious—attacks may go undetected. Prioritize patching for systems in multi-tenant environments, containerized deployments, or those running untrusted local code. Systems that do not use SCTP can be deprioritized or protected by disabling the protocol.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a local attack vector with low complexity and low privilege requirements, affecting user confidentiality, integrity, and availability. The vulnerability does not require user interaction and the attacker has full control over what data is written to the target buffer. Although limited to local access, the ability to silently corrupt userspace memory of other processes elevates the score to HIGH severity. The scope is unchanged (single system) because the impact is confined to the local attack context.

Frequently asked questions