[SRU][Q/N/J][PATCH 0/3] CVE-2026-53246

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53246

[ Impact ]

When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer
INIT chunk embedded after the cookie is parsed and its parameters are later
walked without validating the chunk header length against the remaining
COOKIE_ECHO buffer. If the length field is inflated, the parameter walk can run
beyond the actual received data, leading to out-of-bounds reads and potential
memory corruption during later parameter handling. This is remotely triggerable
and carries a CVSS score of 9.8.

[ Fix ]

questing: backported with AI-assisted adaptation
noble: backported with AI-assisted adaptation
jammy: backported with AI-assisted adaptation
focal: backported with AI-assisted adaptation
bionic: backported with AI-assisted adaptation
xenial: backported with AI-assisted adaptation
trusty: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this change could affect SCTP association setup, since the
added bounds check in sctp_unpack_cookie() gates COOKIE_ECHO processing. An
overly strict check could cause valid COOKIE_ECHO chunks to be rejected,
breaking legitimate SCTP connections.