{"id":11932,"date":"2026-09-04T18:53:58","date_gmt":"2026-09-04T10:53:58","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74752"},"modified":"2026-09-04T18:53:58","modified_gmt":"2026-09-04T10:53:58","slug":"cve-2026-74752","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74752","title":{"rendered":"CVE-2026-74752 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cookie"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>sctp: validate cookie AUTH state before use<\/p>\n<p>When cookie authentication is disabled, COOKIE_ECHO restores fixed-size<br \/>\nAUTH fields directly from peer-controlled cookie bytes.  A forged RANDOM<br \/>\nlength, HMAC list, or CHUNKS list can then reach association consumers<br \/>\nwith lengths or identifiers that were never validated against the local<br \/>\nbacking arrays.<\/p>\n<p>A forged RANDOM length can cause out-of-bounds reads during key-vector<br \/>\nconstruction.  A forged HMAC identifier also caused a 32-byte write past<br \/>\na zero-length AUTH chunk, providing a primitive for a local privilege<br \/>\nescalation chain.<\/p>\n<p>Validate the cookie&#8217;s RANDOM, HMACS, and CHUNKS parameters at the cookie<br \/>\ntrust boundary before copying them into the association.  Reject invalid<br \/>\ntypes, malformed lengths, unsupported HMAC identifiers, HMAC lists<br \/>\nwithout SHA1, and forbidden chunk ids.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>sctp: validate cookie AUTH state before use<\/p>\n<p>When cookie authentication is disabled, COOKIE_ECHO restores fixed-size<br \/>\nAUTH fields di<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11932","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11932","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}