ACK: [SRU][Q/N/J][PATCH 0/3] CVE-2026-53225

[Alessio Faina]

On Fri, Jul 17, 2026 at 02:29:05PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53225
> 
> [ Impact ]
> 
> __sctp_rcv_asconf_lookup() in net/sctp/input.c only verifies that an ASCONF
> chunk can hold the ADDIP header and a parameter header before calling
> af->from_addr_param(), which reads the full address (up to 16 bytes for IPv6)
> based on the parameter's declared length. An unauthenticated SCTP peer can send
> a truncated trailing ASCONF chunk that declares an IPv6 address parameter but
> stops after the 4-byte parameter header, causing the no-association lookup path
> to read uninitialized memory past the parameter. This lets a remote peer read
> up to 16 bytes of uninitialized memory in the receive path.
> 
> [ Fix ]
> 
> questing: backported with AI-assisted adaptation
> noble: clean cherry-pick
> jammy: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
> xenial: clean cherry-pick
> trusty: clean cherry-pick
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A mistake in the added bounds check could reject valid ASCONF chunks in the
> SCTP receive path, breaking dynamic address reconfiguration for legitimate
> associations.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Alessio Faina <alessio.faina at canonical.com>