Cloudanix VulnDB

CVE-2026-68315

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain network reset messages can crash the entire system when received over special high-capacity network links.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Improper validation of stream count in sctp_process_strreset_inreq allows a crafted SCTP RESET_IN_REQUEST to trigger a __u16 size overflow when generating the corresponding RESET_OUT_REQUEST on high-MTU interfaces, resulting in undersized skb allocation and kernel panic via skb_panic/skb_put.

Why it matters to the business

Systems using SCTP over jumbo-frame or loopback IPv6 interfaces can experience sudden kernel crashes and service outages; the low EPSS and absence from KEV indicate limited current exploitation risk but still require prompt remediation to avoid denial-of-service impact.

How an attack unfolds

An attacker establishes an SCTP association and sends a RESET_IN_REQUEST parameter whose length encodes a stream count that is valid for the 8-byte IN header yet produces an OUT request exceeding SCTP_MAX_CHUNK_LEN; on high-MTU paths the kernel proceeds to allocate an undersized skb in sctp_make_strreset_req and panics.

How to fix it

Apply the upstream kernel patch that rejects peer IN requests whose corresponding OUT request would exceed SCTP_MAX_CHUNK_LEN and tightens the local setsockopt check; rebuild and reboot with the fixed kernel image.

How to confirm the fix worked

Confirm the patched kernel contains the validation check in sctp_process_strreset_inreq and sctp_make_strreset_req; replay a boundary-case RESET_IN_REQUEST over a jumbo MTU interface and verify the request is rejected without panic.

Typical attack path

  1. Establish SCTP association with target
  2. Craft RESET_IN_REQUEST with stream list sized to fit IN parameter but overflow OUT calculation
  3. Transmit request over high-MTU path (IPv6 jumbogram or loopback)
  4. Kernel processes request in sctp_process_strreset_inreq and calls sctp_make_strreset_req
  5. Undersized skb triggers skb_panic and kernel BUG

How to detect it

Search kernel logs for skb_panic, skb_put failures, or stack traces containing sctp_process_strreset_inreq and sctp_make_strreset_req; inspect SCTP INIT/ASCNF chunks and subsequent STR_RESET chunks for unusually large stream parameters on high-MTU interfaces.

  • skb_panic
  • sctp_make_strreset_req
  • sctp_process_strreset_inreq
  • sctp_addto_chunk

What your security team should do

  • Prioritize kernel updates for all systems exposing SCTP on high-MTU interfaces
  • Restrict SCTP traffic to trusted peers until patches are deployed
  • Monitor kernel logs for skb_panic or sctp_make_strreset_req crashes
  • Review EPSS trend and re-assess after 30 days if score rises

The record

In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctp_process_strreset_inreq() When processing a RESET_IN_REQUEST from a peer, sctp_process_strreset_inreq() derives the stream count from the parameter length but does not check whether the resulting RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN. The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes larger than the IN request header (sctp_strreset_inreq, 8 bytes). Generally, the IP payload is bounded to 65535 bytes, so the stream list cannot be large enough to trigger the overflow. However, on interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a stream list that fits within the incoming IN parameter can cause a __u16 overflow in sctp_make_strreset_req() when computing the OUT request size, leading to an undersized skb allocation and a kernel BUG: net/core/skbuff.c:207 skb_panic net/core/skbuff.c:2625 skb_put net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req net/sctp/stream.c:655 sctp_process_strreset_inreq The local setsockopt path validates the generated reset request size. However, for an incoming-only reset, it accounts for the smaller IN request even though the peer must generate an OUT request with the same stream list. Such a request cannot be completed successfully by the peer. Reject peer IN requests whose corresponding OUT request would exceed SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an IN request that would require an oversized OUT request from the peer.

Affected packages

Ecosystem Package Introduced Fixed