The Linux kernel SCTP subsystem had a vulnerability (CVE-2026-74287) where sctp_verify_asconf() and sctp_verify_param() only checked that the outer parameter was large enough to contain an embedded address parameter header but did not verify that the embedded address parameter's declared length was within the bounds of the outer parameter. This allowed a malformed peer to advertise an embedded address parameter length that exceeded the remaining bytes in the enclosing parameter, potentially causing out-of-bounds reads when parsing these parameters during INIT or ASCONF processing. The patch validates that the embedded address parameter length does not exceed the available space after the sctp_addip_param header and rejects malformed parameters that violate this constraint, preventing out-of-bounds memory reads.

The vulnerability could lead to out-of-bounds memory reads in the Linux kernel SCTP implementation when processing malformed SCTP parameters. This could potentially cause kernel memory disclosure or instability. There is no indication of known exploits in the wild. The impact is limited to SCTP INIT or ASCONF processing paths.

A fix has been implemented in the Linux kernel to validate embedded address parameter lengths properly and reject malformed parameters that exceed bounds. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed from vendor advisory; check the Linux kernel security advisories for the official fix and update guidance.