Cloudanix VulnDB

CVE-2026-68300

None

CVSS

—

EPSS

0.6%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in Linux networking code can let attackers skip required security checks when setting up certain connections, potentially allowing unauthorized access over the network.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Authentication Bypass
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Authentication bypass in SCTP stack where sctp_auth_chunk_verify returns true unconditionally on NULL auth_chunk, skipping required AUTH checks for COOKIE-ECHO and other chunks in BH receive path.

Why it matters to the business

Attackers may inject or hijack SCTP associations without authentication, risking unauthorized control of network sessions in systems using SCTP for reliable transport.

How an attack unfolds

An attacker sends SCTP chunks such as COOKIE-ECHO without a preceding AUTH chunk; the NULL auth_chunk condition causes the verify function to skip checks, allowing the chunk to proceed even when authentication is required.

How to fix it

Apply the upstream kernel fix that adds an explicit sctp_auth_recv_cid check when auth_chunk is NULL; rebuild and deploy updated kernel images to all affected hosts.

How to confirm the fix worked

Confirm the patched sctp_auth_chunk_verify logic is present in source; test by sending unauthenticated COOKIE-ECHO chunks and verifying they are dropped when AUTH is required.

Typical attack path

  1. Identify target systems exposing SCTP ports
  2. Craft COOKIE-ECHO or similar chunks without AUTH
  3. Trigger skb_clone failure or direct NULL path in receive handling
  4. Bypass sctp_auth_recv_cid check to establish or modify association

How to detect it

Inspect kernel logs and network captures for SCTP COOKIE-ECHO chunks arriving without preceding AUTH chunks; correlate with association setup failures or unexpected new associations.

What your security team should do

  • Prioritize kernel updates on all systems with SCTP enabled
  • Disable SCTP module if not required
  • Monitor for unusual SCTP association establishment attempts
  • Review network segmentation for SCTP traffic

The record

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when auth_chunk is NULL sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, silently skipping authentication. This is incorrect when: 1. skb_clone() failed in the BH receive path, leaving auth_chunk NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new connections, so the early sctp_auth_recv_cid() check cannot catch this. 2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never called and auth_chunk remains NULL. Fix by checking sctp_auth_recv_cid() when auth_chunk is NULL: if authentication is required, return false to drop the chunk; otherwise continue normally.

Affected packages

Ecosystem Package Introduced Fixed