CVE-2026-74752

sctp: validate cookie AUTH state before use

Published Aug 26, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cookie AUTH state before use

When cookie authentication is disabled, COOKIE_ECHO restores fixed-size
AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM
length, HMAC list, or CHUNKS list can then reach association consumers
with lengths or identifiers that were never validated against the local
backing arrays.

A forged RANDOM length can cause out-of-bounds reads during key-vector
construction. A forged HMAC identifier also caused a 32-byte write past
a zero-length AUTH chunk, providing a primitive for a local privilege
escalation chain.

Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie
trust boundary before copying them into the association. Reject invalid
types, malformed lengths, unsupported HMAC identifiers, HMAC lists
without SHA1, and forbidden chunk ids.

Analysis

Technical impact

In the Linux kernel’s SCTP module, improper validation at the cookie trust boundary allows a forged cookie to overrun internal buffers during key-vector construction. The flaw can cause out-of-bounds reads and a 32‑byte write past a zero-length buffer, providing a local privilege escalation primitive.

Affected Systems

All Linux kernel releases that include the SCTP module before the supplied fix are affected. The issue exists in the socket layer handling SCTP cookies; any host running a kernel with SCTP enabled, regardless of distribution, is vulnerable.

Risk and Exploitability

The base CVSS score is 9.8, indicating critical severity. The EPSS score is <1%, suggesting a very low probability of exploitation, though precise likelihood cannot be quantified. The vulnerability is not listed in CISA KEV. The flaw can be triggered by sending crafted SCTP COOKIE_ECHO messages; however, the description does not explicitly confirm network delivery as the attack vector, so this is inferred from the context.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1f485649f52929d9937b346a920a522a7363e202`	affected	< 4a4410de8dc6903d859c9e1731fc6dcee28bd072
`1f485649f52929d9937b346a920a522a7363e202`	affected	< 7f17984cfa697613800eb693e183b06884129bd3
`1f485649f52929d9937b346a920a522a7363e202`	affected	< 88619b117be1daf633ce32210570ce35a0bd1c98
`1f485649f52929d9937b346a920a522a7363e202`	affected	< 3dbb44d88b1e94dd31fe43588af7437b34b44d56

Linux

affected

Version	Status	Constraints
`2.6.24`	affected	—
`0`	unaffected	< 2.6.24
`6.6.160`	unaffected	≤ 6.6.*
`6.12.114`	unaffected	≤ 6.12.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1f485649f52929d9937b346a920a522a7363e202,88619b117be1daf633ce32210570ce35a0bd1c98)`	affected	code_commit	—
`[1f485649f52929d9937b346a920a522a7363e202,3dbb44d88b1e94dd31fe43588af7437b34b44d56)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.24`	affected	semver	—
`[0,2.6.24)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*)`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to a kernel version that contains the SCTP cookie validation fix
If SCTP functionality is unnecessary, unload the module with "modprobe -r sctp" or disable SCTP at compile time
Apply firewall rules to drop or rate‑limit unexpected SCTP COOKIE_ECHO traffic to reduce exposure while the fix is applied

Generated by OpenCVE AI on August 28, 2026 at 07:25 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4904-1	linux-6.12 security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.524% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56
https://git.kernel.org/stable/c/4a4410de8dc6903d859c9e1731fc6dcee28bd072
https://git.kernel.org/stable/c/7f17984cfa697613800eb693e183b06884129bd3
https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98
https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74752-6509@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74752
https://www.cve.org/CVERecord?id=CVE-2026-74752

History

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4a4410de8dc6903d859c9e1731fc6dcee28bd072 https://git.kernel.org/stable/c/7f17984cfa697613800eb693e183b06884129bd3

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 27, 2026 6:00 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-805
References		https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74752-6509@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74752 https://www.cve.org/CVERecord?id=CVE-2026-74752
Metrics	threat_severity `None`	threat_severity `Important`

Aug 27, 2026 9:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-125 CWE-787

Aug 27, 2026 6:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 26, 2026 4:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-125 CWE-787

Aug 26, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays. A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain. Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids.
Title		sctp: validate cookie AUTH state before use
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56 https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98