{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sm_make_chunk.c",
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bca3100f550281c2f2418652338bced3b35af0e6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "062bcbf8d1f1051fdeb20b94920031b0e2cb95a2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "414c5447fe6a200613dd46d7fdc8454622076cb1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sm_make_chunk.c",
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: add INIT verification after cookie unpacking\n\nIn SCTP handshake, the INIT chunk is initially processed by the server\nand embedded into the cookie carried in INIT-ACK. The client then\nreturns this cookie via COOKIE-ECHO, where the server unpacks it and\nreconstructs the original INIT chunk.\n\nWhen cookie authentication is enabled, the cookie contents are protected\nagainst tampering, so reusing the unpacked INIT without re-verification\nis safe.\n\nHowever, when cookie authentication is disabled, the reconstructed INIT\ncan no longer be trusted. In this case, the INIT must be explicitly\nvalidated after unpacking to avoid processing potentially tampered data.\n\nAdd sctp_verify_init() checks after cookie unpacking in COOKIE-ECHO\nprocessing paths (sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook())\nwhen cookie_auth_enable is disabled. On failure, the new association is\nfreed and the packet is discarded.\n\nAlso tighten cookie validation in sctp_unpack_cookie() by verifying the\nembedded chunk type is SCTP_CID_INIT before treating it as an INIT\nchunk.\n\nFinally, update sctp_verify_init() to validate parameter bounds using\nthe actual embedded INIT length instead of chunk-\u003echunk_end, since the\nINIT stored in COOKIE-ECHO may not span the entire chunk buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when a remote peer sends SCTP COOKIE-ECHO packets to a listening endpoint; packets enter through sctp_rcv()/IPv4/IPv6 SCTP handlers and are dispatched to COOKIE-ECHO state handlers without any local access requirement.\nAC:L - On deployments with SCTP cookie authentication disabled (supported via cookie_hmac_alg=none), an attacker can complete INIT/INIT-ACK, tamper with the embedded INIT in the returned cookie, and reliably trigger the vulnerable path with crafted COOKIE-ECHO traffic.\nPR:N - Exploitation is pre-authentication SCTP handshake processing on a listening server; the attacker only needs network reachability to the SCTP port and does not need local privileges, credentials, or CAP_NET_ADMIN on the target.\nUI:N - No victim user action is required beyond operating an SCTP listener; exploitation is achieved solely by sending attacker-crafted SCTP handshake packets over the network.\nS:U - The vulnerability affects the Linux kernel SCTP stack on the target host and does not cross a separate security boundary such as guest-to-host VM escape, container sandbox escape, or IOMMU/DMA isolation bypass.\nC:H - Without sctp_verify_init() and with incorrect INIT parameter bound checks, attacker-controlled embedded INIT lengths/types can drive sctp_walk_params() and kmemdup() beyond valid cookie data, enabling out-of-bounds kernel memory reads.\nI:H - Tampered or type-confused embedded INIT data is parsed into association/peer state via sctp_process_init() without full validation, causing kernel memory-safety corruption that can modify association structures and plausibly be leveraged for stronger write primitives.\nA:H - Malformed embedded INIT processing during COOKIE-ECHO handling can trigger kernel faults, KASAN/oops conditions, allocation failures, or repeated crashes of SCTP input processing, causing high availability impact on internet-facing SCTP services."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:40.793Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bca3100f550281c2f2418652338bced3b35af0e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/062bcbf8d1f1051fdeb20b94920031b0e2cb95a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/414c5447fe6a200613dd46d7fdc8454622076cb1"
        }
      ],
      "title": "sctp: add INIT verification after cookie unpacking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72398",
    "datePublished": "2026-08-15T05:56:24.306Z",
    "dateReserved": "2026-08-09T03:40:39.925Z",
    "dateUpdated": "2026-08-17T05:43:40.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}