CVE-2026-68315
Received Received - Intake

SCTP Stream Reset Length Validation Flaw

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctp_process_strreset_inreq() When processing a RESET_IN_REQUEST from a peer, sctp_process_strreset_inreq() derives the stream count from the parameter length but does not check whether the resulting RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN. The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes larger than the IN request header (sctp_strreset_inreq, 8 bytes). Generally, the IP payload is bounded to 65535 bytes, so the stream list cannot be large enough to trigger the overflow. However, on interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a stream list that fits within the incoming IN parameter can cause a __u16 overflow in sctp_make_strreset_req() when computing the OUT request size, leading to an undersized skb allocation and a kernel BUG: net/core/skbuff.c:207 skb_panic net/core/skbuff.c:2625 skb_put net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req net/sctp/stream.c:655 sctp_process_strreset_inreq The local setsockopt path validates the generated reset request size. However, for an incoming-only reset, it accounts for the smaller IN request even though the peer must generate an OUT request with the same stream list. Such a request cannot be completed successfully by the peer. Reject peer IN requests whose corresponding OUT request would exceed SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an IN request that would require an oversized OUT request from the peer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68315
EUVD
EUVD-2026-55416

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. When processing a RESET_IN_REQUEST from a peer, the kernel does not properly validate the stream count, which can lead to an undersized memory allocation and a kernel crash (BUG). This issue arises on interfaces with MTU greater than 65535 bytes, such as IPv6 jumbograms on loopback.

Detection Guidance

This vulnerability affects the Linux kernel's SCTP implementation. Detection requires checking kernel versions and SCTP-related logs. Monitor for kernel panics or skb_put errors in logs. Use commands like 'dmesg | grep skb_panic' or 'journalctl -k | grep skb_put' to identify crashes. Ensure kernel is updated to a patched version.

Impact Analysis

This vulnerability can cause a kernel panic (crash) on affected systems, leading to denial of service. It may also allow remote attackers to trigger system instability if they can send specially crafted SCTP packets to a vulnerable system.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix. If immediate patching is not possible, disable SCTP by unloading the module with 'rmmod sctp' or block SCTP traffic at the firewall level. Monitor for unusual network activity or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68315. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart