Linux Kernel CVE-2026-72398

Exploitation requires an SCTP endpoint that (1) has the kernel SCTP subsystem active and accepting associations, and (2) is running with cookie authentication disabled (cookie_auth_enable off) - the description states re-verification was skipped specifically in this mode, so that setting IS the enabling condition. The attacker must complete enough of the SCTP handshake to receive an INIT-ACK cookie and return a crafted COOKIE-ECHO containing a tampered embedded INIT, hitting sctp_sf_do_5_1D_ce() or sctp_sf_do_5_2_4_dupcook(). Limiting factors: with cookie authentication enabled (the safe/default posture) the flaw is not reachable, and hosts without SCTP in use are unaffected; no user interaction or prior authentication is needed for the SCTP exchange itself, but the non-default configuration requirement is the primary constraint on real-world risk.

The signals conflict and should be read together rather than off the raw score. The provided CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), which is the Linux CNA's characteristic high-water rating, but the description makes the real precondition explicit: exploitation only matters when cookie_auth_enable is disabled, which is not the default and materially raises attack complexity, so AC:L and the blanket C:H/I:H/A:H are likely overstated for typical deployments. Supporting that, EPSS is only 0.25% (16th percentile), there is no KEV listing, and no public exploit is identified - all pointing to low near-term mass-exploitation risk. The realistic impact, consistent with the 'Information Disclosure' tag and the out-of-bounds parsing fix, is memory over-read (potential leak of kernel memory) or SCTP association/DoS effects rather than confirmed remote code execution. Net: this is a real correctness/validation bug worth patching on any host that actually terminates SCTP with cookie authentication turned off (telecom/SIGTRAN, some clustering and diameter stacks), but for the vast majority of systems where SCTP is not in use or cookie auth is on, it is a high-CVSS-but-low-real-risk item - patch on the normal kernel cadence, prioritizing SCTP-facing hosts. CVSS indicates network vector with no configuration dependency, but the description implies a required non-default setting - verify your cookie_auth_enable state before ranking urgency.

An attacker reachable to an SCTP listener that runs with cookie authentication disabled initiates a handshake, receives the INIT-ACK cookie, then returns a COOKIE-ECHO whose embedded INIT and parameter lengths have been manipulated. Because the pre-patch server re-parses the reconstructed INIT without re-verifying its bounds, the crafted parameters are processed past the real INIT length, driving an out-of-bounds read of kernel memory or destabilizing the association. No public proof-of-concept is currently known, and the network vector is offset by the required non-default configuration.