Linux Kernel CVE-2026-53224

Exploitation requires the target host to have the SCTP module loaded and an SCTP endpoint reachable from the attacker, and the attacker must be able to drive the handshake to the COOKIE_ECHO stage and submit a crafted cookie containing a truncated embedded INIT chunk (length field < sizeof(struct sctp_init_chunk)). The more powerful out-of-bounds primitive via oversized raw_addr_list_len is limited to deployments where SCTP cookie authentication is DISABLED (a non-default setting), because normally the HMAC over the cookie would fail validation before parsing. Limiting factors: SCTP is not enabled/used on most general-purpose servers, the address-list path needs the non-default no-auth configuration, and the impact is bounded to out-of-bounds reads (memory disclosure / crash), not memory writes or code execution.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H = 9.1 Critical) reflects a remote, unauthenticated, low-complexity trigger with high confidentiality and availability impact and no integrity impact - consistent with out-of-bounds reads causing info leak and kernel panic rather than code execution. Against that, EPSS is only 0.21% (11th percentile), there is no CISA KEV listing, and no public PoC is referenced, so real-world exploitation pressure is currently low. A key caveat: the most attacker-controllable primitive (oversized raw_addr_list_len) is explicitly gated on 'when cookie authentication is disabled,' which is NOT the SCTP default - the kernel normally HMAC-signs cookies, so a forged/oversized cookie would fail authentication. The truncated-INIT path is the more broadly reachable issue. The description's own note that sctp_verify_init() ordering is deferred to a separate patch suggests residual hardening work. Net: a genuine remotely-reachable kernel bug worth patching, but lower urgency than its 9.1 score implies because the worst case needs a non-default config and impact is read/DoS, not RCE.

An attacker who can send SCTP traffic to a listening host crafts a COOKIE_ECHO chunk containing an embedded INIT chunk whose length field is smaller than a full INIT header (and, where cookie auth is disabled, an oversized raw_addr_list_len). When the kernel processes the cookie, sctp_process_init() and the address parser read beyond the cookie buffer, leaking adjacent kernel memory or panicking the system. No authentication or user interaction is needed and no public PoC is currently known, so an attacker would need to develop the exploit themselves.