External risk intelligence

Linux Kernel SCTP STALE_COOKIE Length Validation Flaw Information Leak

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-64551

This Linux kernel SCTP vulnerability is network-reachable and triggerable by a peer. While it can be exploited via raw SCTP sockets in namespaces, SCTP is rarely used as a default public-facing service. Exposure depends on specific application configurations or network environments, making it plausibly reachable for some systems but not a ubiquitous target on all internet-connected devices.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This Linux kernel vulnerability involves how specific error messages are handled in the SCTP protocol, potentially leading to the exposure of uninitialized memory. This could allow an attacker to glean sensitive information from affected systems. The main concern is confirming if this specific protocol is in use and exposed within your environment.

Uninitialized memory leakage in Linux kernel.
Confirms relevance and exposure to specific Linux configurations.
Understand if SCTP is in use and exposed.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending a specially crafted ERROR chunk to a system using the SCTP protocol. This can be done over the network by any peer that can establish an SCTP association, even from within a user or network namespace. The vulnerability lies in how the kernel handles a specific type of error message, potentially leading to the disclosure of sensitive information.

Network access required.
Send specific error chunk.
Leak uninitialized memory.

Live Threat

Current exploitation, exposure, and threat context

Uninitialized memory could be exposed to a peer when an ERROR chunk with a STALE_COOKIE cause is received in a specific state within the Linux kernel's SCTP implementation. This exposure occurs when the system attempts to read a "Measure of Staleness" value that may not be fully present, leading to the leak of this uninitialized memory. This vulnerability is reachable by any peer that can establish an SCTP association to the COOKIE_ECHOED state, including through a raw SCTP socket within a user and network namespace.

Kernel memory exposure.
Malformed ERROR chunk triggers leak.
Information disclosure to peer.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's SCTP module impacts systems where SCTP is used and associations can be driven into the COOKIE_ECHOED state. Responsibility likely falls to infrastructure or platform teams managing the kernel, with potential involvement from network or security teams if SCTP is exposed externally. The first practical step is to identify all systems running the affected kernel version, determine if SCTP is enabled and accessible, and assess business criticality before planning remediation.

Own by infrastructure or platform teams.
Verify SCTP usage and reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SCTP component affected by CVE-2026-64551?

SCTP (Stream Control Transmission Protocol) is a transport layer protocol used by some network applications to send data between computers. The Linux kernel provides the underlying code that processes these network connections. This CVE concerns how the kernel handles specific error messages during the setup phase of these connections, which is a core function of its networking stack.

What kind of vulnerability is CVE-2026-64551?

This is an information disclosure vulnerability caused by improper input validation. When the kernel processes an SCTP error message, it may attempt to read data from memory before verifying that the data actually exists. If the message is malformed, the kernel may inadvertently copy uninitialized memory—which could contain sensitive data from previous operations—and send it back to the remote peer.

How can an attacker trigger this vulnerability?

An attacker must be able to initiate an SCTP association with the target system and drive it into a specific state called COOKIE_ECHOED. By sending a specially crafted 'ERROR' chunk that lacks the expected data length, they can trick the kernel into reading past the end of the message. Connections that do not reach this specific state or are not using the SCTP protocol are not susceptible to this flaw.

Why is Halo Surface Signal labeling this as 'Possible'?

While the vulnerability is network-reachable, SCTP is not a standard service on every internet-facing device. Many systems do not use or enable SCTP, or they restrict it to internal networks. Halo Surface Signal identifies this as 'Possible' because it depends heavily on your specific application configurations and whether you actively run services that utilize SCTP associations.

What should I do if I run systems with this Linux kernel?

First, determine if your systems use the SCTP protocol, as this is a prerequisite for the vulnerability. If SCTP is in use, confirm the accessibility of these services—whether they are internal or exposed to the internet. Work with your infrastructure or platform teams to identify the affected kernel versions in your environment and prioritize patching based on the business criticality of those specific systems.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.