Answer in brief
CVE-2026-53225 records a Critical severity (CVSS 9.1) vulnerability in sctp: fix uninit-value in __sctp_rcv_asconf_lookup(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=df21857714398acb8b24a8bb5a6d2286dd9c59ef <446e0ecd845abc394b24ae2030a883572bec9d16 || >=df21857714398acb8b24a8bb5a6d2286dd9c59ef <928dd94db23e8ba340f83d68f7f24d831b7a4426 || >=df21857714398acb8b24a8bb5a6d2286dd9c59ef <d796cfd06074b579d265b28401306cadd30db945 || >=df21857714398acb8b24a8bb5a6d2286dd9c59ef <8ce96f1182644079249a24ac7e2ffc32e0301a46 || >=df21857714398acb8b24a8bb5a6d2286dd9c59ef <d6bd0bb7697ea8c0387b0d9d973453f479017b23 || >=df21857714398acb8b24a8bb5a6d2286dd9c59ef <f76a8b323e28e0951f979dbef20a7496383c47df || >=df21857714398acb8b24a8bb5a6d2286dd9c59ef <8e86817b8af4d552f3c6fe04ca52bb0c8c57411d || >=df21857714398acb8b24a8bb5a6d2286dd9c59ef <f8373d7090b745728de66308deeecc67e8d319ce | 446e0ecd845abc394b24ae2030a883572bec9d16, 928dd94db23e8ba340f83d68f7f24d831b7a4426, d796cfd06074b579d265b28401306cadd30db945, 8ce96f1182644079249a24ac7e2ffc32e0301a46, d6bd0bb7697ea8c0387b0d9d973453f479017b23, f76a8b323e28e0951f979dbef20a7496383c47df, 8e86817b8af4d552f3c6fe04ca52bb0c8c57411d, f8373d7090b745728de66308deeecc67e8d319ce |
| Linux/Linuxgeneric | 2.6.25 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
Jun 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 25, 2026
In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop").
Quoted source text, attributed separately from HOL analysis.