[SRU][Q/N/J][PATCH 0/3] CVE-2026-53224

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53224

[ Impact ]

sctp_unpack_cookie() only verified that the embedded INIT chunk length did not
exceed the remaining cookie payload, but did not ensure the INIT chunk was
large enough to hold a complete INIT header. A malformed COOKIE_ECHO can carry
a truncated INIT chunk, and sctp_process_init() then accesses INIT parameters
unconditionally, leading to out-of-bounds reads. Additionally,
raw_addr_list_len is not fully validated against the remaining payload, so when
cookie authentication is disabled an attacker can supply an oversized length
and cause sctp_raw_to_bind_addrs() and the address parser to read beyond the
end of the cookie.

[ Fix ]

questing: backported with AI-assisted adaptation
noble: backported with AI-assisted adaptation
jammy: backported with AI-assisted adaptation
focal: backported with AI-assisted adaptation
bionic: backported with AI-assisted adaptation
xenial: backported with AI-assisted adaptation
trusty: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

The change adds stricter length validation to the SCTP cookie unpacking path,
so an incorrect fix could reject legitimate COOKIE_ECHO chunks and break SCTP
association establishment. Regressions would be confined to the SCTP protocol
subsystem.