Cloudanix VulnDB

CVE-2026-68320

High · 7.3

CVSS

7.3

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking bug can let someone already on the machine cause crashes or take over more control than they should have.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability is a 4-byte buffer overflow in memcpy during sctp_association_init() when ep->auth_chunk_list exceeds 16 entries; the check incorrectly uses SCTP_NUM_CHUNK_TYPES (20) instead of the destination struct sctp_cookie capacity SCTP_AUTH_MAX_CHUNKS (16).

Why it matters to the business

Local attackers can crash affected Linux systems or escalate privileges, leading to service disruption, data integrity loss, or unauthorized access on servers and devices using SCTP.

How an attack unfolds

An attacker with local access adds more than 16 authentication chunk IDs via sctp_auth_ep_add_chunkid(), causing sctp_association_init() to overflow the 16-entry auth_chunks buffer by up to 4 bytes during cookie handling.

How to fix it

Apply the upstream kernel patch that changes the capacity check in sctp_auth_ep_add_chunkid() to use SCTP_AUTH_MAX_CHUNKS; rebuild and deploy updated kernels on all affected systems.

How to confirm the fix worked

Verify the fix is present by inspecting the sctp_auth_ep_add_chunkid() source for the SCTP_AUTH_MAX_CHUNKS constant or confirm the running kernel is newer than the vulnerable commit; test by attempting to add 17 auth chunks and confirming no overflow occurs.

Typical attack path

  1. Gain local user access on a Linux system with SCTP enabled
  2. Invoke sctp_auth_ep_add_chunkid() more than 16 times to exceed destination capacity
  3. Trigger association initialization to execute the overflowing memcpy
  4. Leverage the resulting memory corruption for denial of service or privilege escalation

How to detect it

Search kernel logs and audit trails for repeated SCTP authentication chunk additions or association initialization failures; examine core dumps or memory analysis for overflows near sctp_cookie structures.

What your security team should do

  • Prioritize patching kernel packages on all SCTP-using systems within 30 days
  • Restrict local user access and SCTP socket privileges where possible
  • Monitor EPSS and exploit maturity for any rise indicating weaponization
  • Audit custom SCTP applications for auth chunk handling

The record

In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, allowing it to hold up to 20 chunk entries (param_hdr.length up to 24). However, the copy destination asoc->c.auth_chunks in struct sctp_cookie is only SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16 chunks are added, sctp_association_init() memcpy overflows the destination by up to 4 bytes. Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.

Affected packages

Ecosystem Package Introduced Fixed