CVE-2026-72398 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, SCTP protocol implementers, and organizations using Linux-based systems with SCTP functionality should be aware of this vulnerability. They should review and apply the provided kernel patches to ensure SCTP INIT verification is performed when cookie authentication is disabled. Additionally, they should verify that SCTP cookie authentication is enabled, if possible, and monitor SCTP traffic for potential tampering attempts. Organizations using Linux-based systems with SCTP functionality should also consider implementing additional compensating controls, such as network monitoring and intrusion detection, to mitigate the vulnerability.

Technical summary

The Linux kernel's SCTP implementation is vulnerable to tampering with INIT chunks when cookie authentication is disabled. The fix adds explicit validation of INIT chunks after cookie unpacking in COOKIE-ECHO processing paths. This validation ensures that the reconstructed INIT chunk is trustworthy and prevents processing of tampered data. The vulnerability affects the Linux kernel's SCTP handshake process, specifically when cookie authentication is disabled. The fix is implemented in the COOKIE-ECHO processing paths, ensuring that INIT chunks are verified before being processed.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to ensure SCTP INIT verification is performed when cookie authentication is disabled.
• Verify that SCTP cookie authentication is enabled, if possible.
• Monitor SCTP traffic for potential tampering attempts.
• Consider implementing additional compensating controls, such as network monitoring and intrusion detection.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis of the Linux kernel's SCTP implementation and the provided source references is necessary to fully understand the vulnerability and its potential impact. The vulnerability allows for potential tampering with INIT chunks when cookie authentication is disabled. This could lead to processing of tampered data, potentially causing issues with SCTP connections. To verify the vulnerability, defenders should review the Linux kernel's SCTP implementation and the provided source references. They should also monitor SCTP traffic for potential tampering attempts and consider implementing additional compensating controls.

Official resources