CVE-2026-53004
Received Received - Intake
BaseFortify

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks sctp_getsockopt_peer_auth_chunks() checks that the caller's optval buffer is large enough for the peer AUTH chunk list with if (len < num_chunks) return -EINVAL; but then writes num_chunks bytes to p->gauth_chunks, which lives at offset offsetof(struct sctp_authchunks, gauth_chunks) == 8 inside optval. The check is missing the sizeof(struct sctp_authchunks) = 8-byte header. When the caller supplies len == num_chunks (for any num_chunks > 0) the test passes but copy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes past the declared buffer. The sibling function sctp_getsockopt_local_auth_chunks() at the next line already has the correct check: if (len < sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL; Align the peer variant with its sibling. Reproducer confirms on v7.0-13-generic: an unprivileged userspace caller that opens a loopback SCTP association with AUTH enabled, queries num_chunks with a short optval, then issues the real getsockopt with len == num_chunks and sentinel bytes painted past the buffer observes those sentinel bytes overwritten with the peer's AUTH chunk type. The bytes written are under the peer's control but land in the caller's own userspace; this is not a kernel memory corruption, but it is a kernel-side contract violation that can silently corrupt adjacent userspace data.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-25
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-53004
EUVD
EUVD-2026-38872
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 7.0 (inc)
linux linux_kernel 7.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically in the function sctp_getsockopt_peer_auth_chunks(). The function attempts to check if the user's buffer is large enough to hold the peer AUTH chunk list, but the check is incorrect because it does not account for an 8-byte header structure. As a result, when the buffer size equals the number of chunks, the function writes 8 bytes beyond the end of the buffer into user space.

This out-of-bounds write is not a kernel memory corruption but a violation of the kernel's contract with user space, which can silently overwrite adjacent user space data with bytes controlled by the peer.

Impact Analysis

The vulnerability can cause silent corruption of adjacent user space data by writing bytes controlled by a peer beyond the intended buffer boundary. This could lead to unexpected behavior or data integrity issues in user space applications that use SCTP with AUTH enabled.

Since the bytes written are under the peer's control, this could potentially be exploited to manipulate user space data, although it does not directly corrupt kernel memory.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart