CVE-2026-68376
Received Received - Intake

Buffer Overflow in Linux Kernel SCTP Cookie Handling

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers. However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie. As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac(). Fix the array size calculation by including the full SCTP parameter header size.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68376
EUVD
EUVD-2026-55562

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves an incorrect array size calculation in the SCTP protocol implementation. The auth_hmacs array in struct sctp_cookie was sized using an extra 2 bytes instead of the correct 4-byte struct sctp_paramhdr size. This causes buffer overflow when four HMAC identifiers are configured, leading to memory corruption and potential invalid HMAC identifier acceptance.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCTP implementation and requires kernel-level inspection. Detection involves checking kernel version and SCTP configuration. Use uname -a to verify kernel version and grep for SCTP in kernel logs or configuration. No direct network commands detect this as it is a local kernel memory corruption issue.

Impact Analysis

This vulnerability could allow an attacker to cause memory corruption in the Linux kernel, potentially leading to system crashes, privilege escalation, or unauthorized access. Systems using SCTP with multiple HMAC configurations are most at risk.

Mitigation Strategies

Apply the kernel patch provided by your Linux distribution to fix the auth_hmacs array size in struct sctp_cookie. Update to a kernel version that includes the fix. If immediate patching is not possible, disable SCTP support if not required or restrict network exposure to trusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68376. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart