CVE-2026-64551 in Linux
Summary
by MITRE • 07/28/2026
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate STALE_COOKIE cause length before reading staleness
When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure of Staleness that follows the cause header:
err = (struct sctp_errhdr *)(chunk->skb->data); stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
err is the first cause in the chunk, not the STALE_COOKIE cause that caused the dispatch, and nothing guarantees the staleness field is present. sctp_walk_errors() only requires a cause to be as long as the 4-byte header, so for a STALE_COOKIE cause of length 4 the read runs past the cause, and for a minimal ERROR chunk past skb->tail. The value is echoed to the peer in the Cookie Preservative of the reply INIT, leaking uninitialized memory.
sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so check its length there and pass it to sctp_sf_do_5_2_6_stale(), which reads that cause instead of the first one. A STALE_COOKIE cause too short to hold the staleness field is discarded.
The read is reachable by any peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability exists within the Linux kernel's Stream Control Transmission Protocol implementation where improper validation of STALE_COOKIE cause lengths leads to memory disclosure issues. The flaw occurs specifically when processing ERROR chunks containing STALE_COOKIE causes while an association is in the COOKIE_ECHOED state, representing a critical security gap that can be exploited by remote attackers.
The technical implementation error stems from incorrect pointer arithmetic and lack of bounds checking during error chunk processing. When sctp_sf_do_5_2_6_stale() function attempts to read the 4-byte Measure of Staleness field, it incorrectly references the first cause header in the chunk rather than specifically targeting the STALE_COOKIE cause that triggered the dispatch. This fundamental flaw arises because sctp_walk_errors() only validates that each cause meets the minimum 4-byte header requirement without ensuring sufficient length for subsequent data fields. The function assumes the staleness field is always present at a fixed offset from the error header, creating a potential buffer overflow condition.
The operational impact of this vulnerability extends beyond simple memory disclosure to represent a significant information leak risk. The uninitialized memory values read from the improperly validated STALE_COOKIE cause are echoed back to the peer in the Cookie Preservative field of the reply INIT chunk, potentially exposing sensitive kernel memory contents to remote adversaries. This vulnerability affects any peer capable of establishing an SCTP association in the COOKIE_ECHOED state, including unprivileged processes utilizing raw SCTP sockets within user and network namespaces, making it particularly dangerous in multi-tenant environments.
This issue relates to CWE-129 Improper Validation of Array Index and CWE-787 Out-of-bounds Write in the context of SCTP protocol implementation. The vulnerability may also map to ATT&CK technique T1059 Command and Scripting Interpreter for executing malicious SCTP traffic patterns that trigger the memory disclosure condition. The root cause demonstrates poor input validation and insufficient bounds checking that violates fundamental security principles for network protocol implementations.
The fix implemented addresses this by ensuring proper cause length validation before any data access occurs. The sctp_sf_cookie_echoed_err() function now correctly walks to the STALE_COOKIE cause and verifies its length before passing it to sctp_sf_do_5_2_6_stale(). This approach follows secure coding practices by performing input validation before data processing, preventing the out-of-bounds memory read that previously occurred. The solution also includes proper error handling for minimal ERROR chunks where the STALE_COOKIE cause is too short to contain the required staleness field, ensuring invalid causes are properly discarded rather than processed.
The mitigation strategy involves applying the kernel patch that implements the length validation check before memory access operations. Organizations should prioritize updating their Linux kernel versions to include this fix, particularly in environments where SCTP traffic is processed or where untrusted network peers may establish associations. Network segmentation and firewall rules can provide additional defense-in-depth measures by limiting SCTP traffic exposure, while monitoring for unusual ERROR chunk patterns may help detect exploitation attempts. This vulnerability underscores the importance of proper bounds checking in kernel network protocol implementations and demonstrates how seemingly minor validation gaps can lead to significant information disclosure risks.