CVE-2026-53246

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

When a listening SCTP server processes a COOKIE_ECHO chunk, the cached

peer INIT chunk embedded after the cookie is parsed and its parameters

are later walked by sctpprocessinit() using sctpwalkparams().

However, the chunk header length of this cached INIT chunk was not

validated against the remaining buffer in the COOKIE_ECHO payload. If

the length field is inflated, the parameter walk can run beyond the

actual received data, leading to out-of-bounds reads and potential

memory corruption during later parameter handling (e.g. STATE_COOKIE

processing and kmemdup() copies).

Add a bounds check in sctpunpackcookie() to ensure the cached INIT

chunk length does not exceed the available data in the COOKIE_ECHO

buffer before it is used.