Linux Kernel EUVD-2026-55562

SCTP (Stream Control Transmission Protocol) authentication is defined in RFC 4895 and implemented in the Linux kernel's net/sctp subsystem. The vulnerability originates in an off-by-two sizing error in struct sctp_cookie: the auth_hmacs array was dimensioned using 2 extra bytes rather than the full sizeof(struct sctp_paramhdr) which is 4 bytes, producing a 2-byte undersized buffer. When a peer endpoint advertises exactly four HMAC identifiers, the HMAC-ALGO parameter stored in the endpoint exceeds the auth_hmacs buffer capacity. During sctp_association_init(), the kernel copies this oversized parameter beyond the end of auth_hmacs, silently corrupting the adjacent auth_chunks field in the same cookie structure. The corrupted auth_chunks value can cause an invalid HMAC identifier to pass validation, which subsequently triggers an out-of-bounds read in sctp_auth_get_hmac(). Although the NVD does not assign a CWE, this maps directly to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) with a secondary CWE-125 (Out-of-bounds Read) in the follow-on path. The bug was introduced with commit 1f485649f52929d9937b346a920a522a7363e202, present since Linux 2.6.24 when SCTP authentication support was added.