CVE-2026-68320 (GCVE-0-2026-68320)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-08-19 16:33
VLAI
Title
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, allowing it to hold up to 20 chunk entries (param_hdr.length up to 24). However, the copy destination asoc->c.auth_chunks in struct sctp_cookie is only SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16 chunks are added, sctp_association_init() memcpy overflows the destination by up to 4 bytes. Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1f485649f52929d9937b346a920a522a7363e202 , < 3d22a7da2e264f407c729f33a0a346ff76108bc6 (git)
Affected: 1f485649f52929d9937b346a920a522a7363e202 , < 6837c1c19a259518974cbc5a52017646e3906564 (git)
Affected: 1f485649f52929d9937b346a920a522a7363e202 , < 54bb4c03fa17cdcb157c26c33e60a78cf32960f5 (git)
Affected: 1f485649f52929d9937b346a920a522a7363e202 , < 5a365f1e423444c5da7eb689a8661633dad43e48 (git)
Affected: 1f485649f52929d9937b346a920a522a7363e202 , < 886e28e14ab655012779016d251fef53d103aa12 (git)
Affected: 1f485649f52929d9937b346a920a522a7363e202 , < 11092d79eb2b7c0068382f72fc2416d1786bb2e0 (git)
Affected: 1f485649f52929d9937b346a920a522a7363e202 , < b6ea3dda09eb4d5caf7bbc00f857688cf9e98255 (git)
Affected: 1f485649f52929d9937b346a920a522a7363e202 , < ff04b26794a16a8a879eb4fd2c02c2d6b03850e9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.24
Unaffected: 0 , < 2.6.24 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d22a7da2e264f407c729f33a0a346ff76108bc6",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            },
            {
              "lessThan": "6837c1c19a259518974cbc5a52017646e3906564",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            },
            {
              "lessThan": "54bb4c03fa17cdcb157c26c33e60a78cf32960f5",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            },
            {
              "lessThan": "5a365f1e423444c5da7eb689a8661633dad43e48",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            },
            {
              "lessThan": "886e28e14ab655012779016d251fef53d103aa12",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            },
            {
              "lessThan": "11092d79eb2b7c0068382f72fc2416d1786bb2e0",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            },
            {
              "lessThan": "b6ea3dda09eb4d5caf7bbc00f857688cf9e98255",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            },
            {
              "lessThan": "ff04b26794a16a8a879eb4fd2c02c2d6b03850e9",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid\n\nsctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the\ncapacity limit for ep-\u003eauth_chunk_list, allowing it to hold up to\n20 chunk entries (param_hdr.length up to 24). However, the copy\ndestination asoc-\u003ec.auth_chunks in struct sctp_cookie is only\nSCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16\nchunks are added, sctp_association_init() memcpy overflows the\ndestination by up to 4 bytes.\n\nFix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching\nthe destination capacity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow condition can only be created locally: an attacker must call setsockopt(SCTP_AUTH_SUPPORTED) and then setsockopt(SCTP_AUTH_CHUNK) more than 16 times on an SCTP socket they own. A remote peer can trigger the memcpy by connecting to such a socket, but cannot itself populate the oversized chunk list.\nAC:L - The sequence is fully deterministic and entirely under attacker control \u2014 enable AUTH, add 17-20 distinct chunk IDs, then create an association via connect() or accept(); no race, timing window, or memory-layout condition is involved.\nPR:L - Creating an IPPROTO_SCTP socket and issuing SCTP_AUTH_SUPPORTED/SCTP_AUTH_CHUNK setsockopts requires no capability; sctp_setsockopt_auth_supported() enables AUTH per-endpoint regardless of the net.sctp.auth_enable sysctl, so any unprivileged local user reaches the bug.\nUI:N - The attacker performs every step from their own process \u2014 socket setup, setsockopt calls, and association establishment \u2014 with no action required from any other user or administrator.\nS:U - The corruption and the over-read are confined to the kernel\u0027s own SCTP association object; no other security authority or privilege domain is crossed.\nC:L - sctp_make_init()/sctp_make_init_ack() copy ntohs(auth_chunks-\u003elength) bytes from the 20-byte field, emitting up to 4 bytes past it (the adjacent raw_addr_list_len) inside the CHUNKS parameter of INIT/INIT-ACK sent to the remote peer \u2014 a real but small, strictly bounded out-of-bounds read.\nI:H - sctp_association_init() writes up to 4 bytes of fully attacker-chosen data (the chunk-ID values) past the end of asoc-\u003ec.auth_chunks into the adjacent kernel struct field, an out-of-bounds write of controlled content into kernel memory.\nA:H - On CONFIG_FORTIFY_SOURCE kernels the memcpy is flagged as a field-spanning write and emits a WARN, which is fatal on the widely used panic_on_warn configurations, and the out-of-bounds write itself corrupts SCTP association state; the trigger is cheap and repeatable by any local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:33:10.661Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d22a7da2e264f407c729f33a0a346ff76108bc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6837c1c19a259518974cbc5a52017646e3906564"
        },
        {
          "url": "https://git.kernel.org/stable/c/54bb4c03fa17cdcb157c26c33e60a78cf32960f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a365f1e423444c5da7eb689a8661633dad43e48"
        },
        {
          "url": "https://git.kernel.org/stable/c/886e28e14ab655012779016d251fef53d103aa12"
        },
        {
          "url": "https://git.kernel.org/stable/c/11092d79eb2b7c0068382f72fc2416d1786bb2e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6ea3dda09eb4d5caf7bbc00f857688cf9e98255"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff04b26794a16a8a879eb4fd2c02c2d6b03850e9"
        }
      ],
      "title": "sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68320",
    "datePublished": "2026-08-10T12:02:55.144Z",
    "dateReserved": "2026-07-30T09:28:09.382Z",
    "dateUpdated": "2026-08-19T16:33:10.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68320",
      "date": "2026-09-22",
      "epss": "0.00127",
      "percentile": "0.02748"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sctp/auth.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3d22a7da2e264f407c729f33a0a346ff76108bc6",
                    "status": "affected",
                    "version": "1f485649f52929d9937b346a920a522a7363e202",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6837c1c19a259518974cbc5a52017646e3906564",
                    "status": "affected",
                    "version": "1f485649f52929d9937b346a920a522a7363e202",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "54bb4c03fa17cdcb157c26c33e60a78cf32960f5",
                    "status": "affected",
                    "version": "1f485649f52929d9937b346a920a522a7363e202",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5a365f1e423444c5da7eb689a8661633dad43e48",
                    "status": "affected",
                    "version": "1f485649f52929d9937b346a920a522a7363e202",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "886e28e14ab655012779016d251fef53d103aa12",
                    "status": "affected",
                    "version": "1f485649f52929d9937b346a920a522a7363e202",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "11092d79eb2b7c0068382f72fc2416d1786bb2e0",
                    "status": "affected",
                    "version": "1f485649f52929d9937b346a920a522a7363e202",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b6ea3dda09eb4d5caf7bbc00f857688cf9e98255",
                    "status": "affected",
                    "version": "1f485649f52929d9937b346a920a522a7363e202",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ff04b26794a16a8a879eb4fd2c02c2d6b03850e9",
                    "status": "affected",
                    "version": "1f485649f52929d9937b346a920a522a7363e202",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sctp/auth.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.24"
                  },
                  {
                    "lessThan": "2.6.24",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid\n\nsctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the\ncapacity limit for ep-\u003eauth_chunk_list, allowing it to hold up to\n20 chunk entries (param_hdr.length up to 24). However, the copy\ndestination asoc-\u003ec.auth_chunks in struct sctp_cookie is only\nSCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16\nchunks are added, sctp_association_init() memcpy overflows the\ndestination by up to 4 bytes.\n\nFix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching\nthe destination capacity."
          }
        ],
        "id": "CVE-2026-68320",
        "lastModified": "2026-08-19T17:20:42.260",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:22.050",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/11092d79eb2b7c0068382f72fc2416d1786bb2e0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3d22a7da2e264f407c729f33a0a346ff76108bc6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/54bb4c03fa17cdcb157c26c33e60a78cf32960f5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5a365f1e423444c5da7eb689a8661633dad43e48"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6837c1c19a259518974cbc5a52017646e3906564"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/886e28e14ab655012779016d251fef53d103aa12"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b6ea3dda09eb4d5caf7bbc00f857688cf9e98255"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ff04b26794a16a8a879eb4fd2c02c2d6b03850e9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:22:04+00:00",
      "cve": "CVE-2026-68320",
      "id": "CVE-2026-68320",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "275",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68320.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:32:08Z",
      "cve": "CVE-2026-68320",
      "id": "CVE-2026-68320",
      "initial_release_date": "2026-08-11T23:48:01Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "731",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68320",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68320.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.