CVE-2026-68320sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, allowing it to hold up to 20 chunk entries (param_hdr.length up to 24). However, the copy destination asoc->c.auth_chunks in struct sctp_cookie is only SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16 chunks are added, sctp_association_init() memcpy overflows the destination by up to 4 bytes. Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.
- CVSS
- 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1f485649f52929d9937b346a920a522a7363e202 before 3d22a7da2e264f407c729f33a0a346ff76108bc6; from 1f485649f52929d9937b346a920a522a7363e202 before 6837c1c19a259518974cbc5a52017646e3906564; from 1f485649f52929d9937b346a920a522a7363e202 before 54bb4c03fa17cdcb157c26c33e60a78cf32960f5; from 1f485649f52929d9937b346a920a522a7363e202 before 5a365f1e423444c5da7eb689a8661633dad43e48; from 1f485649f52929d9937b346a920a522a7363e202 before 886e28e14ab655012779016d251fef53d103aa12; from 1f485649f52929d9937b346a920a522a7363e202 before 11092d79eb2b7c0068382f72fc2416d1786bb2e0; from 1f485649f52929d9937b346a920a522a7363e202 before b6ea3dda09eb4d5caf7bbc00f857688cf9e98255; from 1f485649f52929d9937b346a920a522a7363e202 before ff04b26794a16a8a879eb4fd2c02c2d6b03850e9 | CNA record |
References
- https://git.kernel.org/stable/c/3d22a7da2e264f407c729f33a0a346ff76108bc6
- https://git.kernel.org/stable/c/6837c1c19a259518974cbc5a52017646e3906564
- https://git.kernel.org/stable/c/54bb4c03fa17cdcb157c26c33e60a78cf32960f5
- https://git.kernel.org/stable/c/5a365f1e423444c5da7eb689a8661633dad43e48
- https://git.kernel.org/stable/c/886e28e14ab655012779016d251fef53d103aa12
- https://git.kernel.org/stable/c/11092d79eb2b7c0068382f72fc2416d1786bb2e0
- https://git.kernel.org/stable/c/b6ea3dda09eb4d5caf7bbc00f857688cf9e98255
- https://git.kernel.org/stable/c/ff04b26794a16a8a879eb4fd2c02c2d6b03850e9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.