PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53004 Linux CVE debrief

A Linux kernel vulnerability was found in the SCTP implementation. The issue occurs in the sctp_getsockopt_peer_auth_chunks function, where an out-of-bounds write to userspace can happen. This happens because the function checks if the provided buffer is large enough for the peer's AUTH chunk list but does not account for the size of the struct sctp_authchunks header. An unprivileged userspace caller can exploit this by providing a short buffer, leading to the overwrite of adjacent userspace data with the peer's AUTH chunk type.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-24
Original CVE updated
2026-07-10
Advisory published
2026-06-24
Advisory updated
2026-07-10

Who should care

Linux kernel users and administrators should be aware of this vulnerability, especially those using SCTP with AUTH enabled. This vulnerability can lead to silent corruption of userspace data.

Technical summary

The sctp_getsockopt_peer_auth_chunks function in the Linux kernel's SCTP implementation does not properly validate the provided buffer size. Specifically, it checks if the buffer length is less than the number of chunks but does not account for the 8-byte header of the struct sctp_authchunks. This can lead to an out-of-bounds write when the caller provides a buffer that is too small. The vulnerability can be exploited by an unprivileged userspace caller that has opened a loopback SCTP association with AUTH enabled.

Defensive priority

High

Recommended defensive actions

  • Apply the kernel patch that fixes the sctp_getsockopt_peer_auth_chunks function
  • Review and update SCTP configurations to ensure proper buffer sizing
  • Monitor systems for unusual behavior related to SCTP and AUTH chunks
  • Perform a thorough review of system logs to identify potential exploitation attempts
  • Implement additional monitoring to detect anomalies in SCTP traffic
  • Verify that all SCTP associations are properly configured and validated
  • Check for any unauthorized changes to SCTP configuration files

Evidence notes

The vulnerability was resolved in the Linux kernel. The fix aligns the peer variant of the function with its sibling, sctp_getsockopt_local_auth_chunks, which already had the correct check. Reproducer code confirms the vulnerability on affected systems.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-24T17:17:11.510Z and has not been modified since then.