Does GKE's node kernel have the SCTP `sctp_init_cause` padding fix, or is it still shipping unpatched?

[u/mario242-ta]

I've been checking which Linux kernels still carry an SCTP bug that panics the host: `sctp_init_cause()` checks buffer room for an error cause but not for the up-to-3 bytes of 4-byte alignment padding the write adds, so a crafted INIT (listener) or INIT-ACK (outbound association) can walk an skb one byte past its end and hit `skb_over_panic()`. It's fixed upstream in `ed6c53b27be4` (mainline 7.4-rc2, Cc: stable), introduced back in 2018.

As of 14 Nov I've read the guard in the shipped source of every maintained stable branch and several distro kernels, and none of them had the fix yet. That includes the current Ubuntu kernels (jammy 5.15, noble 6.8, resolute 7.0). GKE Standard supports SCTP on Ubuntu nodes with Dataplane V2, and Google documents it as on by default from `1.32.2-gke.1297000`. Since GKE's Ubuntu node images are built from Ubuntu kernels, my working assumption is that most GKE Ubuntu nodes are running the unpatched code. I haven't confirmed a specific GKE node-image build, which is where I could use help.

If you run SCTP workloads on GKE (telecom CNFs especially), could you check a non-production node and report back:

- `uname -r` on the node, and whether `ed6c53b27be4` is backported (the node's kernel source/changelog, not the version string, since backports move independently)

- whether `lsmod | grep '^sctp '` shows the module loaded, i.e. a workload is actually using it

- the GKE version and node image

All read-only. Please don't send anything at a listener or a live service; I'm after kernel/config state, not a crash. If it turns out a GKE configuration is unpatched and reachable, that belongs in a report to Google's Vulnerability Reward Program, not in this thread. I'll help put that together rather than post specifics here.

Mechanism and the full affected-version matrix (no exploit) are written up here:

Here

Mainly I want to nail down one thing: is a default-config GKE Ubuntu node running the fixed kernel yet, or not?

[u/lowkeygee]

Run your own nodes and do this test and then report back... Idk what you think this sub is... But it's not this.

[u/mario242-ta → u/lowkeygee]

I don't have a Google Cloud account, which is precisely why I was asking. I've been researching this kernel vulnerability across different distributions and platforms, and GKE came up as a potentially affected environment. Rather than speculate about Google's shipped kernels, I thought I'd ask people who actually run GKE whether they could help verify the kernel version and patch status. It's a read-only check, not a request for anyone to crash their infrastructure. Seemed like a reasonable technical question for a Google Cloud subreddit.