CVE-2026-74752 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and apply patches. Affected operators and platform administrators should verify the authenticity of cookie AUTH state before use and take steps to remediate the vulnerability. Vulnerability management and security teams should also review and apply the relevant patches from the Linux kernel and monitor for suspicious activity on SCTP

Why it matters

CVE-2026-74752 is a critical vulnerability in the Linux kernel's SCTP implementation that allows for potential local privilege escalation. Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and apply patches.

• Local privilege escalation is possible due to out-of-bounds writes
• Out-of-bounds reads can occur during key-vector construction
• Verify the authenticity of cookie AUTH state before use
• Remediation requires applying patches from the Linux kernel

Technical summary

The Linux kernel's SCTP implementation does not validate cookie AUTH state before use, allowing for potential local privilege escalation. The vulnerability is caused by the lack of validation of cookie AUTH state before use, which could allow an attacker to forge RANDOM length, HMAC list, or CHUNKS list, leading to out-of-bounds reads and writes. This vulnerability has been resolved in various Linux kernel commits. Affected Linux kernel developers and maintainers should assess exposure and apply patches. Linux distribution vendors and users of Linux-based systems are also advised to verify the authenticity of cookie AUTH state before use and take steps to remediate the vulnerability.

Defensive priority

High

Recommended defensive actions

• Review and apply the relevant patches from the Linux kernel
• Restrict access to SCTP services to trusted sources
• Monitor for suspicious activity on SCTP services
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of validation of cookie AUTH state before use in the Linux kernel's SCTP implementation. This could allow an attacker to forge RANDOM length, HMAC list, or CHUNKS list, leading to out-of-bounds reads and writes. The vulnerability has been resolved in various Linux kernel commits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.