Linux Kernel EUVD-2026-66582

Exploitation requires the SCTP subsystem to be in use (module loaded) and, critically, endpoint cookie authentication (RFC 4895 AUTH) to be DISABLED - that specific configuration is the code path where fixed-size AUTH fields are restored from peer-controlled cookie bytes without validation. The attacker must supply a COOKIE_ECHO whose embedded AUTH parameters contain a forged RANDOM length (for the OOB read) or a forged HMAC identifier (for the 32-byte OOB write), i.e., control over the echoed cookie contents. Limiting factors: this is not reachable on default hosts that do not load SCTP or that keep cookie authentication enabled; the reporter frames the memory-write outcome as a LOCAL privilege escalation chain, implying a local unprivileged account rather than pure remote exploitation despite the NVD AV:N scoring. No user interaction is needed once an association can be initiated.

The signals conflict and must be reconciled rather than taken at face value. NVD scores this 9.8 with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H - a fully remote, unauthenticated critical - yet the reporter's own description characterizes the concrete write primitive as feeding 'a local privilege escalation chain,' which points to a local attacker (e.g., an unprivileged user opening SCTP sockets over loopback) rather than a drive-by internet exploit; verify the true attack vector with the vendor before treating this as remote-unauth RCE. Exploitation is further gated on a non-default state: cookie authentication being disabled and the SCTP module being loaded/in use, which is uncommon in general-purpose fleets. There is no KEV listing, no POC, and no EPSS score in the provided data, so there is no evidence of active or automated exploitation. Net: a genuinely serious memory-corruption bug with a plausible LPE impact on hosts that actually use SCTP, but the headline 9.8 overstates real-world reachability for typical deployments; teams running SCTP-dependent workloads (telecom signaling/SIGTRAN, some clustering) should prioritize it, while environments without SCTP face limited exposure.

A local unprivileged user on a host where the SCTP module is loaded and endpoint cookie authentication is disabled opens an SCTP association (for example over loopback) and completes the handshake with a crafted COOKIE_ECHO carrying a forged HMAC identifier and RANDOM length. Restoration of these unvalidated AUTH fields triggers an out-of-bounds read and a 32-byte write past a zero-length AUTH chunk in kernel memory, which the attacker grooms into a privilege-escalation primitive to gain root. No public exploit is identified at time of analysis, and the low attack complexity of the memory bug is offset by the non-default cookie-auth-disabled prerequisite.