CVE-2026-68300sctp: auth: verify auth requirement when auth_chunk is NULL
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when auth_chunk is NULL sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, silently skipping authentication. This is incorrect when: 1. skb_clone() failed in the BH receive path, leaving auth_chunk NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new connections, so the early sctp_auth_recv_cid() check cannot catch this. 2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never called and auth_chunk remains NULL. Fix by checking sctp_auth_recv_cid() when auth_chunk is NULL: if authentication is required, return false to drop the chunk; otherwise continue normally.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bbd0d59809f923ea2b540cbd781b32110e249f6e before a129792b3aef15002746c13522781d92ed3522c3; from bbd0d59809f923ea2b540cbd781b32110e249f6e before 5a022ac51ad83b4ce6c898f4b9eefc65bd26b247; from bbd0d59809f923ea2b540cbd781b32110e249f6e before 6caf0e8590c0bf05a76b0d387726adf3a6f3725c; from bbd0d59809f923ea2b540cbd781b32110e249f6e before ec2e157fc9678a9bc411305a25aec3fd337d7efb; from bbd0d59809f923ea2b540cbd781b32110e249f6e before 28c5fdce9dd955d2baf5e28987819b6d7cfaf646; from bbd0d59809f923ea2b540cbd781b32110e249f6e before 18957373920caf5cdaf5cf32e5d1d7a99ca7700a; from bbd0d59809f923ea2b540cbd781b32110e249f6e before 83f5031f2a6a49d696eb4cc0898345d12f9c6451; from bbd0d59809f923ea2b540cbd781b32110e249f6e before 8e04823c120b376ef7dab14b60ebf6823aa16c14 | CNA record |
References
- https://git.kernel.org/stable/c/a129792b3aef15002746c13522781d92ed3522c3
- https://git.kernel.org/stable/c/5a022ac51ad83b4ce6c898f4b9eefc65bd26b247
- https://git.kernel.org/stable/c/6caf0e8590c0bf05a76b0d387726adf3a6f3725c
- https://git.kernel.org/stable/c/ec2e157fc9678a9bc411305a25aec3fd337d7efb
- https://git.kernel.org/stable/c/28c5fdce9dd955d2baf5e28987819b6d7cfaf646
- https://git.kernel.org/stable/c/18957373920caf5cdaf5cf32e5d1d7a99ca7700a
- https://git.kernel.org/stable/c/83f5031f2a6a49d696eb4cc0898345d12f9c6451
- https://git.kernel.org/stable/c/8e04823c120b376ef7dab14b60ebf6823aa16c14
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.