CVE-2026-74287 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate embedded address parameter length
sctp_verify_asconf() and sctp_verify_param() only validate ADD_IP, DEL_IP, and SET_PRIMARY parameters against a fixed minimum size of sizeof(struct sctp_addip_param) + sizeof(struct sctp_paramhdr). This ensures the outer parameter is large enough to contain an embedded address parameter header, but does not verify that the embedded address parameter's declared length fits within the bounds of the outer parameter.
Later, sctp_process_param() and sctp_process_asconf_param() extract the embedded address parameter and pass it to af->from_addr_param(), which uses the address parameter length to parse the variable-length address payload. A malformed peer can therefore advertise an embedded address parameter length that exceeds the remaining bytes in the enclosing parameter.
Validate that addr_param->p.length does not exceed the space available after the sctp_addip_param header before processing the embedded address parameter. Reject malformed parameters when the embedded address length extends beyond the enclosing parameter bounds.
This prevents out-of-bounds reads when parsing malformed parameters carried in INIT or ASCONF processing paths.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical out-of-bounds read condition within the Linux kernel's Stream Control Transmission Protocol implementation that stems from inadequate validation of embedded address parameters in SCTP control messages. This weakness exists specifically within the sctp_verify_asconf() and sctp_verify_param() functions which perform initial validation checks on ADD_IP, DEL_IP, and SET_PRIMARY parameters by verifying only against a fixed minimum size that includes the sctp_addip_param header plus sctp_paramhdr structure. However, this validation approach fails to ensure that the embedded address parameter's declared length remains within the bounds of its containing outer parameter structure. The flaw creates a scenario where a malicious peer can craft SCTP messages with malformed address parameters that declare lengths exceeding the available space within their enclosing parameter boundaries.
The technical execution of this vulnerability occurs through the SCTP processing pipeline where sctp_process_param() and sctp_process_asconf_param() functions extract embedded address parameters and pass them to af->from_addr_param() for parsing. When the embedded address parameter length exceeds the remaining bytes in the outer parameter, the parsing function attempts to read beyond allocated memory boundaries, resulting in out-of-bounds memory access patterns that can lead to system instability or potential code execution exploits. This vulnerability directly maps to CWE-129 Improper Validation of Array Index and CWE-787 Out-of-bounds Write conditions within the Common Weakness Enumeration framework, as it involves improper validation of parameter lengths leading to memory access violations.
The operational impact of this vulnerability extends across multiple SCTP processing paths including both INIT and ASCONF message handling scenarios, making it particularly dangerous as it affects fundamental network communication protocols. Attackers can exploit this weakness by sending carefully crafted SCTP packets that cause the kernel to attempt reading beyond valid memory regions during parameter parsing operations. This could result in system crashes, denial of service conditions, or potentially more severe consequences depending on how the out-of-bounds read manifests within the kernel's memory management subsystem. The vulnerability affects systems running Linux kernels that implement SCTP functionality and could be exploited by remote attackers without authentication requirements.
Mitigation strategies should focus on implementing proper bounds checking for embedded parameter lengths before processing occurs, ensuring that addr_param->p.length values do not exceed the available space after accounting for the sctp_addip_param header. The recommended fix involves validating that embedded address parameter lengths remain within the physical bounds of their containing outer parameters and rejecting malformed configurations during early validation phases. System administrators should apply kernel updates containing this patch immediately, while network security teams should monitor for potential exploitation attempts in their traffic monitoring systems. This vulnerability also aligns with ATT&CK technique T1059 Command and Scripting Interpreter where attackers might leverage such kernel vulnerabilities to execute unauthorized code or escalate privileges within affected systems.