APPLIED[N:hwe-6.17/N/J]/Cmnt: [SRU][Q/N/J][PATCH 0/3] CVE-2026-53224

[Edoardo Canepa]

Applied to N:linux/hwe-6.17-next and N/J:linux/master-next.

Adjusted to previous applied CVE-2026-53246

Thanks.

On 7/17/26 18:37, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53224
>
> [ Impact ]
>
> sctp_unpack_cookie() only verified that the embedded INIT chunk length did not
> exceed the remaining cookie payload, but did not ensure the INIT chunk was
> large enough to hold a complete INIT header. A malformed COOKIE_ECHO can carry
> a truncated INIT chunk, and sctp_process_init() then accesses INIT parameters
> unconditionally, leading to out-of-bounds reads. Additionally,
> raw_addr_list_len is not fully validated against the remaining payload, so when
> cookie authentication is disabled an attacker can supply an oversized length
> and cause sctp_raw_to_bind_addrs() and the address parser to read beyond the
> end of the cookie.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
> noble: backported with AI-assisted adaptation
> jammy: backported with AI-assisted adaptation
> focal: backported with AI-assisted adaptation
> bionic: backported with AI-assisted adaptation
> xenial: backported with AI-assisted adaptation
> trusty: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> The change adds stricter length validation to the SCTP cookie unpacking path,
> so an incorrect fix could reject legitimate COOKIE_ECHO chunks and break SCTP
> association establishment. Regressions would be confined to the SCTP protocol
> subsystem.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260730/914b06c1/attachment.sig>