CVE-2026-68376
High · 8.1CVSS
8.1
EPSS
0.6%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A calculation error in the Linux kernel's handling of network authentication data can let attackers read or overwrite memory they should not access, potentially allowing them to take control of the system.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- High
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds write during sctp_association_init() caused by undersized auth_hmacs array in struct sctp_cookie (miscalculated using 2 bytes instead of sizeof(struct sctp_paramhdr)), corrupting the adjacent auth_chunks field and enabling invalid HMAC acceptance plus later out-of-bounds read in sctp_auth_get_hmac().
Why it matters to the business
On systems using SCTP authentication, memory corruption can lead to remote code execution or denial of service; low exploitability reduces immediate risk but kernel updates remain necessary for long-term safety.
How an attack unfolds
An attacker sends an SCTP INIT or COOKIE-ECHO carrying an AUTH_HMAC_ALGO parameter with four HMAC identifiers; the oversized parameter overflows the cookie buffer during association setup, corrupting auth_chunks and allowing an invalid HMAC to be accepted, followed by an out-of-bounds read when sctp_auth_get_hmac() is later invoked.
How to fix it
Apply the upstream Linux kernel patch that corrects the auth_hmacs array size calculation to use sizeof(struct sctp_paramhdr); rebuild and deploy updated kernels on all affected systems.
How to confirm the fix worked
Confirm the patch is present by inspecting the sctp_cookie structure definition and the sctp_association_init() array-size computation in the kernel source; test SCTP association establishment with four HMAC identifiers.
Typical attack path
- Craft SCTP packet containing AUTH_HMAC_ALGO parameter with four identifiers
- Initiate SCTP association to trigger sctp_association_init()
- Trigger memory corruption of auth_chunks field
- Cause sctp_auth_get_hmac() to perform out-of-bounds read
How to detect it
Review kernel logs and SCTP association traces for unexpected HMAC identifier values or crashes in sctp_auth_get_hmac(); examine memory dumps around struct sctp_cookie for corruption of fields adjacent to auth_hmacs.
What your security team should do
- Prioritize kernel updates on any hosts exposing SCTP ports
- Monitor EPSS and exploit maturity trends for changes in risk
- Review SCTP configuration to disable authentication if not required
The record
In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers. However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie. As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac(). Fix the array size calculation by including the full SCTP parameter header size.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|