CVE-2026-53224

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate embedded INIT chunk and address list lengths in cookie

sctpunpackcookie() only checked that the embedded INIT chunk length

did not exceed the remaining cookie payload, but did not ensure that the

INIT chunk is large enough to contain a complete INIT header.

A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose

length field is smaller than sizeof(struct sctpinitchunk).  Later,

sctpprocessinit() accesses INIT parameters unconditionally, which may

lead to out-of-bounds reads.

In addition, rawaddrlist_len is not fully validated against the

remaining cookie payload. When cookie authentication is disabled, an

attacker can supply an oversized rawaddrlist_len and cause

sctprawtobindaddrs() to read beyond the end of the cookie. The

address parser also lacks sufficient bounds checks for parameter headers

and lengths, allowing malformed address parameters to trigger

out-of-bounds reads.

Fix this by:

• requiring the embedded INIT chunk length to be at least sizeof(struct

  sctpinitchunk);

• validating that the INIT chunk and raw address list together fit

  within the cookie payload;

• verifying sufficient data exists for each address parameter header and

  payload before parsing it.

Note that sctpverifyinit() must be called after sctpunpackcookie()

and before sctpprocessinit() when cookie authentication is disabled.

This will be addressed in a separate patch.