{"id":"OESA-2026-3986","summary":"kernel security update","details":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate STALE_COOKIE cause length before reading staleness\n\nWhen an ERROR chunk with a STALE_COOKIE cause is received in the\nCOOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure\nof Staleness that follows the cause header:\n\n\terr   = (struct sctp_errhdr *)(chunk->skb->data);\n\tstale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));\n\nerr is the first cause in the chunk, not the STALE_COOKIE cause that\ncaused the dispatch, and nothing guarantees the staleness field is\npresent. sctp_walk_errors() only requires a cause to be as long as the\n4-byte header, so for a STALE_COOKIE cause of length 4 the read runs\npast the cause, and for a minimal ERROR chunk past skb->tail. The value\nis echoed to the peer in the Cookie Preservative of the reply INIT,\nleaking uninitialized memory.\n\nsctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so\ncheck its length there and pass it to sctp_sf_do_5_2_6_stale(), which\nreads that cause instead of the first one. A STALE_COOKIE cause too\nshort to hold the staleness field is discarded.\n\nThe read is reachable by any peer that can drive an association into\nCOOKIE_ECHOED, including an unprivileged process using a raw SCTP socket\nin a user and network namespace.(CVE-2026-64551)","modified":"2026-09-20T13:30:24.486775208Z","published":"2026-09-20T13:23:51Z","upstream":["CVE-2026-64551"],"database_specific":{"severity":"Critical"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3986"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64551"}],"affected":[{"package":{"name":"kernel","ecosystem":"openEuler:22.03-LTS-SP4","purl":"pkg:rpm/openEuler/kernel&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-332.0.0.233.oe2203sp4"}]}],"ecosystem_specific":{"aarch64":["bpftool-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","bpftool-debuginfo-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","kernel-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","kernel-debuginfo-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","kernel-debugsource-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","kernel-devel-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","kernel-headers-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","kernel-source-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","kernel-tools-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","kernel-tools-debuginfo-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","kernel-tools-devel-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","perf-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","perf-debuginfo-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","python3-perf-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm","python3-perf-debuginfo-5.10.0-332.0.0.233.oe2203sp4.aarch64.rpm"],"src":["kernel-5.10.0-332.0.0.233.oe2203sp4.src.rpm"],"x86_64":["bpftool-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","bpftool-debuginfo-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","kernel-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","kernel-debuginfo-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","kernel-debugsource-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","kernel-devel-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","kernel-headers-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","kernel-source-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","kernel-tools-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","kernel-tools-debuginfo-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","kernel-tools-devel-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","perf-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","perf-debuginfo-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","python3-perf-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm","python3-perf-debuginfo-5.10.0-332.0.0.233.oe2203sp4.x86_64.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-3986.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}]}