Linux Kernel CVE-2026-53225

The vulnerability is in the kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically the ASCONF (Address Configuration) chunk handling used for dynamic address reconfiguration (RFC 5061). On the no-association lookup path, __sctp_rcv_asconf_lookup() checks only that an incoming chunk is large enough to hold the ADDIP header plus a parameter header, then invokes the address-family from_addr_param() callback, which copies the full declared address - 16 bytes for an IPv6 address parameter - based on the attacker-supplied parameter length. Because the code open-codes the parameter fetch instead of using the bounded sctp_walk_params() helper (as the sibling __sctp_rcv_init_lookup() does), a parameter that declares an IPv6 address but is truncated to just its 4-byte header causes from_addr_param() to read beyond the chunk boundary into uninitialized skb memory. Root cause is a classic missing-bounds-check / use of uninitialized memory (akin to CWE-908/CWE-125), the same defect class as the earlier KMSAN fix commit 51e5ad549c43 in sctp_inq_pop(); the input data lists CWE as N/A.