CVE-2026-53246: linux Out-of-bounds Write

Vulnerability summary

CVE-2026-53246 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37% of scored vulnerabilities.

Showing 100 of 237. Use Open JSON for the complete list.

Timeline

1. 25-06-2026
   PublishedVulnerability first disclosed.
2. 16-10-2026
   Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.