APPLIED[N:hwe-6.17/N/J]: [SRU][Q/N/J][PATCH 0/3] CVE-2026-53246

[Edoardo Canepa]

Applied to n:linux/hwe-6.17-next and n/j:linux/master-next. Thanks.

On 7/17/26 17:32, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53246
>
> [ Impact ]
>
> When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer
> INIT chunk embedded after the cookie is parsed and its parameters are later
> walked without validating the chunk header length against the remaining
> COOKIE_ECHO buffer. If the length field is inflated, the parameter walk can run
> beyond the actual received data, leading to out-of-bounds reads and potential
> memory corruption during later parameter handling. This is remotely triggerable
> and carries a CVSS score of 9.8.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
> noble: backported with AI-assisted adaptation
> jammy: backported with AI-assisted adaptation
> focal: backported with AI-assisted adaptation
> bionic: backported with AI-assisted adaptation
> xenial: backported with AI-assisted adaptation
> trusty: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this change could affect SCTP association setup, since the
> added bounds check in sctp_unpack_cookie() gates COOKIE_ECHO processing. An
> overly strict check could cause valid COOKIE_ECHO chunks to be rejected,
> breaking legitimate SCTP connections.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260730/32dfdd26/attachment.sig>