Critical Vulnerability: CVE-2026-64551

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate STALE_COOKIE cause length before reading staleness

When an ERROR chunk with a STALE_COOKIE cause is received in the

COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure

of Staleness that follows the cause header:

err = (struct sctp_errhdr *)(chunk->skb->data);

stale = ntohl((__be32 )((u8 )err + sizeof(err)));

err is the first cause in the chunk, not the STALE_COOKIE cause that

caused the dispatch, and nothing guarantees the staleness field is

present. sctp_walk_errors() only requires a cause to be as long as the

4-byte header, so for a STALE_COOKIE cause of length 4 the read runs

past the cause, and for a minimal ERROR chunk past skb->tail. The value

is echoed to the peer in the Cookie Preservative of the reply INIT,

leaking uninitialized memory.

sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so

check its length there and pass it to sctp_sf_do_5_2_6_st

CVE-2026-64551 is rated CRITICAL severity, requiring immediate attention from security teams.

CVSS Base Score: 9.1/10

EPSS (Exploit Prediction): 0.2% probability of exploitation in the next 30 days.

Use Vulnios to continuously monitor your exposure to CVE-2026-64551 and similar vulnerabilities.

Vulnios scans for this vulnerability using Trivy and Grype for SBOM-based CVE matching and Vulnios CVE feed continuous monitoring against your asset inventory. Run a scan against your environment to see whether you are exposed; findings are linked back to the original CVE record so triage starts with the patch path already known.