APPLIED[HWE-6.17/N/J]/Cmnt: [SRU][Q/N/J][PATCH 0/3] CVE-2026-53225

[Stefan Bader]

On 17/07/2026 13:29, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53225
> 
> [ Impact ]
> 
> __sctp_rcv_asconf_lookup() in net/sctp/input.c only verifies that an ASCONF
> chunk can hold the ADDIP header and a parameter header before calling
> af->from_addr_param(), which reads the full address (up to 16 bytes for IPv6)
> based on the parameter's declared length. An unauthenticated SCTP peer can send
> a truncated trailing ASCONF chunk that declares an IPv6 address parameter but
> stops after the 4-byte parameter header, causing the no-association lookup path
> to read uninitialized memory past the parameter. This lets a remote peer read
> up to 16 bytes of uninitialized memory in the receive path.
> 
> [ Fix ]
> 
> questing: backported with AI-assisted adaptation
> noble: clean cherry-pick
> jammy: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
> xenial: clean cherry-pick
> trusty: clean cherry-pick
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A mistake in the added bounds check could reject valid ASCONF chunks in the
> SCTP receive path, breaking dynamic address reconfiguration for legitimate
> associations.
> 

Applied to noble,jammy:linux/master-next and 
noble:linux-hwe-6.17/hwe-6.17-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 52669 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260717/e689f937/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260717/e689f937/attachment-0001.sig>