{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74752", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.931Z", "datePublished": "2026-08-26T14:36:59.548Z", "dateUpdated": "2026-08-27T05:01:12.709Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:01:12.709Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cookie AUTH state before use\n\nWhen cookie authentication is disabled, COOKIE_ECHO restores fixed-size\nAUTH fields directly from peer-controlled cookie bytes. A forged RANDOM\nlength, HMAC list, or CHUNKS list can then reach association consumers\nwith lengths or identifiers that were never validated against the local\nbacking arrays.\n\nA forged RANDOM length can cause out-of-bounds reads during key-vector\nconstruction. A forged HMAC identifier also caused a 32-byte write past\na zero-length AUTH chunk, providing a primitive for a local privilege\nescalation chain.\n\nValidate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie\ntrust boundary before copying them into the association. Reject invalid\ntypes, malformed lengths, unsupported HMAC identifiers, HMAC lists\nwithout SHA1, and forbidden chunk ids."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is reached when a remote peer sends SCTP COOKIE-ECHO to a listening endpoint; packets enter sctp_rcv() and are handled in sctp_sf_do_5_1D_ce()/sctp_unpack_cookie() with no local syscall required on the victim.\nAC:L - With SCTP-AUTH enabled and cookie_hmac_alg=none, an attacker completes INIT/INIT-ACK, forges peer-controlled AUTH fields in the returned cookie, and reliably triggers sctp_auth_make_key_vector()/sctp_auth_calculate_hmac() via COOKIE-ECHO without races or uncontrollable conditions.\nPR:N - Exploitation is pre-authentication SCTP handshake processing on a listening server; the attacker only needs network reachability to the SCTP port and does not need local account privileges, capabilities, or init-namespace root on the target host.\nUI:N - No victim user action is required beyond normal SCTP listener operation; exploitation is achieved solely by sending attacker-crafted COOKIE-ECHO packets over the network during association setup or restart.\nS:U - The vulnerability corrupts kernel memory inside the SCTP stack on the target host and enables kernel privilege escalation; it does not cross a separate security boundary such as guest-to-host VM escape or IOMMU/DMA isolation bypass.\nC:H - A forged RANDOM length copied from an unauthenticated cookie drives sctp_auth_make_key_vector() to memcpy() beyond the fixed auth_random backing array, enabling out-of-bounds kernel memory reads during association shared-key construction.\nI:H - Forged HMAC identifiers from the cookie can yield a zero-length AUTH chunk while sctp_auth_calculate_hmac() still writes a 32-byte digest past the allocation, providing a heap overflow primitive the fix commit notes can chain to local privilege escalation.\nA:H - Out-of-bounds reads and the 32-byte heap overflow during COOKIE-ECHO processing can trigger kernel faults, oops, or panic on SCTP servers, and malformed AUTH state can repeatedly crash association input handling."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sctp/auth.h", "net/sctp/auth.c", "net/sctp/sm_make_chunk.c"], "versions": [{"version": "1f485649f52929d9937b346a920a522a7363e202", "lessThan": "88619b117be1daf633ce32210570ce35a0bd1c98", "status": "affected", "versionType": "git"}, {"version": "1f485649f52929d9937b346a920a522a7363e202", "lessThan": "3dbb44d88b1e94dd31fe43588af7437b34b44d56", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sctp/auth.h", "net/sctp/auth.c", "net/sctp/sm_make_chunk.c"], "versions": [{"version": "2.6.24", "status": "affected"}, {"version": "0", "lessThan": "2.6.24", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98"}, {"url": "https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56"}], "title": "sctp: validate cookie AUTH state before use", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/sctp/auth.h", "net/sctp/auth.c", "net/sctp/sm_make_chunk.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "88619b117be1daf633ce32210570ce35a0bd1c98", "status": "affected", "version": "1f485649f52929d9937b346a920a522a7363e202", "versionType": "git"}, {"lessThan": "3dbb44d88b1e94dd31fe43588af7437b34b44d56", "status": "affected", "version": "1f485649f52929d9937b346a920a522a7363e202", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/sctp/auth.h", "net/sctp/auth.c", "net/sctp/sm_make_chunk.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.24"}, {"lessThan": "2.6.24", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cookie AUTH state before use\n\nWhen cookie authentication is disabled, COOKIE_ECHO restores fixed-size\nAUTH fields directly from peer-controlled cookie bytes. A forged RANDOM\nlength, HMAC list, or CHUNKS list can then reach association consumers\nwith lengths or identifiers that were never validated against the local\nbacking arrays.\n\nA forged RANDOM length can cause out-of-bounds reads during key-vector\nconstruction. A forged HMAC identifier also caused a 32-byte write past\na zero-length AUTH chunk, providing a primitive for a local privilege\nescalation chain.\n\nValidate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie\ntrust boundary before copying them into the association. Reject invalid\ntypes, malformed lengths, unsupported HMAC identifiers, HMAC lists\nwithout SHA1, and forbidden chunk ids."}], "id": "CVE-2026-74752", "lastModified": "2026-08-27T06:17:26.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-26T15:16:54.270", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}