Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53004— sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于sctp_getsockopt_peer_auth_chunks()函数中缺少8字节header长度检查，可能允许未经授权的用户空间调用者通过越界写入导致相邻用户空间数据被静默破坏。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.13% · P2

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 65b07e5d0d09c77e98050b5f0146ead29e5add32< a132e199de69e2a45628aa8534df1bf5d44e1b6e affected
65b07e5d0d09c77e98050b5f0146ead29e5add32< 2b5a2c957c7769d40110f725cf23987fcef50d75 affected
65b07e5d0d09c77e98050b5f0146ead29e5add32< d45c7e99caf915b0f6c716bd8ffe9d45b9685761 affected
65b07e5d0d09c77e98050b5f0146ead29e5add32< d67fbc6dea5dbf7f46c618ebf65910a276078e20 affected
65b07e5d0d09c77e98050b5f0146ead29e5add32< 6849b995cda88a677bf08a05765d1db7905974fc affected
65b07e5d0d09c77e98050b5f0146ead29e5add32< 70a089cc9590aa347a61e84434116ab74619e3c3 affected
65b07e5d0d09c77e98050b5f0146ead29e5add32< 6bcf8fe4ef7967b22b814cbae9a57bbd3c853410 affected
65b07e5d0d09c77e98050b5f0146ead29e5add32< 0cf004ffb61cd32d140531c3a84afe975f9fc7ea affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53004

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks sctp_getsockopt_peer_auth_chunks() checks that the caller's optval buffer is large enough for the peer AUTH chunk list with if (len < num_chunks) return -EINVAL; but then writes num_chunks bytes to p->gauth_chunks, which lives at offset offsetof(struct sctp_authchunks, gauth_chunks) == 8 inside optval. The check is missing the sizeof(struct sctp_authchunks) = 8-byte header. When the caller supplies len == num_chunks (for any num_chunks > 0) the test passes but copy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes past the declared buffer. The sibling function sctp_getsockopt_local_auth_chunks() at the next line already has the correct check: if (len < sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL; Align the peer variant with its sibling. Reproducer confirms on v7.0-13-generic: an unprivileged userspace caller that opens a loopback SCTP association with AUTH enabled, queries num_chunks with a short optval, then issues the real getsockopt with len == num_chunks and sentinel bytes painted past the buffer observes those sentinel bytes overwritten with the peer's AUTH chunk type. The bytes written are under the peer's control but land in the caller's own userspace; this is not a kernel memory corruption, but it is a kernel-side contract violation that can silently corrupt adjacent userspace data.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于sctp_getsockopt_peer_auth_chunks()函数中缺少8字节header长度检查，可能允许未经授权的用户空间调用者通过越界写入导致相邻用户空间数据被静默破坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 65b07e5d0d09c77e98050b5f0146ead29e5add32 ~ a132e199de69e2a45628aa8534df1bf5d44e1b6e -
Linux Linux 2.6.24 -

II. Public POCs for CVE-2026-53004

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53004

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53004 (6)

Same Patch Batch · Linux · 2026-06-24 · 219 CVEs total

CVE-2026-53049 9.8 CRITICAL gfs2: add some missing log locking
CVE-2026-52993 9.8 CRITICAL tipc: fix double-free in tipc_buf_append()
CVE-2026-52989 9.8 CRITICAL nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
CVE-2026-52986 9.8 CRITICAL netfilter: nf_conntrack_sip: don't use simple_strtoul
CVE-2026-52982 9.8 CRITICAL net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
CVE-2026-53002 9.8 CRITICAL netfilter: conntrack: remove sprintf usage
CVE-2026-53006 9.8 CRITICAL ipv6: fix possible UAF in icmpv6_rcv()
CVE-2026-53045 9.8 CRITICAL memory: tegra124-emc: Fix dll_change check
CVE-2026-53086 9.8 CRITICAL net: bcmgenet: fix racing timeout handler
CVE-2026-53046 9.8 CRITICAL ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
CVE-2026-52955 9.8 CRITICAL libceph: Fix potential out-of-bounds access in crush_decode()
CVE-2026-53010 9.8 CRITICAL ksmbd: fix use-after-free in smb2_open during durable reconnect
CVE-2026-53088 9.8 CRITICAL net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
CVE-2026-52914 9.8 CRITICAL batman-adv: fix fragment reassembly length accounting
CVE-2026-53055 9.8 CRITICAL crypto: hisilicon/sec2 - prevent req used-after-free for sec
CVE-2026-52924 9.8 CRITICAL sctp: purge outqueue on stale COOKIE-ECHO handling
CVE-2026-52931 9.8 CRITICAL batman-adv: tp_meter: avoid use of uninit sender vars
CVE-2026-52999 9.1 CRITICAL netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
CVE-2026-53043 9.1 CRITICAL ocfs2/dlm: validate qr_numregions in dlm_match_regions()
CVE-2026-52958 9.1 CRITICAL libceph: Fix potential out-of-bounds access in osdmap_decode()

Showing top 20 of 219 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-53004

No comments yet

Leave a comment