CVE-2026-68376sctp: fix auth_hmacs array size in struct sctp_cookie
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers. However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie. As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac(). Fix the array size calculation by including the full SCTP parameter header size.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1f485649f52929d9937b346a920a522a7363e202 before 317731d01b03c529809df36d3a7d149677a8729d; from 1f485649f52929d9937b346a920a522a7363e202 before 0528485f27016a42804abe01aa61b39d85fa803e; from 1f485649f52929d9937b346a920a522a7363e202 before ee5e65964f456adfe14d526fba0bd055de98ecf3; 1f485649f52929d9937b346a920a522a7363e202 builds before 0b4414e43e0861d67276031cc21401d7e87de3da; from 1f485649f52929d9937b346a920a522a7363e202 before d0a59ba58578e2b330fff80a44fe519f3ba7d8c7; from 1f485649f52929d9937b346a920a522a7363e202 before a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db; from 1f485649f52929d9937b346a920a522a7363e202 before 3aa40c3bccac2312ea7cf97f329190637f972b5d; from 1f485649f52929d9937b346a920a522a7363e202 before e0b5252a59383b77d1b8dbeda00b7184dd95f4d3 | CNA record |
References
- https://git.kernel.org/stable/c/317731d01b03c529809df36d3a7d149677a8729d
- https://git.kernel.org/stable/c/0528485f27016a42804abe01aa61b39d85fa803e
- https://git.kernel.org/stable/c/ee5e65964f456adfe14d526fba0bd055de98ecf3
- https://git.kernel.org/stable/c/0b4414e43e0861d67276031cc21401d7e87de3da
- https://git.kernel.org/stable/c/d0a59ba58578e2b330fff80a44fe519f3ba7d8c7
- https://git.kernel.org/stable/c/a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db
- https://git.kernel.org/stable/c/3aa40c3bccac2312ea7cf97f329190637f972b5d
- https://git.kernel.org/stable/c/e0b5252a59383b77d1b8dbeda00b7184dd95f4d3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.