sctp: validate cookie AUTH state before use
Published Aug 26, 2026
9.8
CRITICALCVSS 3.1
EPSS 0.65%
Description
When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays.
A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain.
Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 2.6.24StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<2.6.24
- Version 7.1.10StatusunaffectedConstraints<=7.1.*
- Version 7.2StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
No data.
No data.
Red Hat Enterprise Linux 10
kernel
Affected
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Affected
Red Hat Enterprise Linux 7
kernel-rt
Affected
Red Hat Enterprise Linux 8
kernel
Affected
Red Hat Enterprise Linux 8
kernel-rt
Affected
Red Hat Enterprise Linux 9
kernel
Affected
Red Hat Enterprise Linux 9
kernel-rt
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | n/a |
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Affected | n/a |
| Red Hat Enterprise Linux 9 | kernel | Affected | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This Important flaw in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation could allow a local attacker to achieve privilege escalation. When SCTP cookie authentication is disabled, the kernel fails to properly validate AUTH fields from peer-controlled cookie bytes, leading to out-of-bounds memory access. This could result in a local privilege escalation.
Red Hat mitigation
To mitigate this vulnerability, prevent the `sctp` kernel module from loading by creating a blacklist configuration as detailed below. [How do I prevent a kernel module from loading automatically?](https://access.redhat.com/solutions/41278) Note: Disabling the `sctp` module may impact services that rely on SCTP for communication. A system reboot is required for the mitigation to be fully applied.
References (7)
- https://access.redhat.com/security/cve/CVE-2026-74752 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2524422 Issue Tracking
- https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56
- https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98
- https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74752-6509@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2026-74752
- https://www.cve.org/CVERecord?id=CVE-2026-74752
Change history (0)
No recorded changes yet.