CVE-2026-68320

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

State: Published
Severity: 7.3 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, allowing it to hold up to 20 chunk entries (param_hdr.length up to 24). However, the copy destination asoc->c.auth_chunks in struct sctp_cookie is only SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16 chunks are added, sctp_association_init() memcpy overflows the destination by up to 4 bytes.

Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H	Linux

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
LinuxLinux	1f485649f52929d9937b346a920a522a7363e202 to before 3d22a7da2e264f407c729f33a0a346ff76108bc6Affected 1f485649f52929d9937b346a920a522a7363e202 to before 6837c1c19a259518974cbc5a52017646e3906564Affected 1f485649f52929d9937b346a920a522a7363e202 to before 54bb4c03fa17cdcb157c26c33e60a78cf32960f5Affected 1f485649f52929d9937b346a920a522a7363e202 to before 5a365f1e423444c5da7eb689a8661633dad43e48Affected 1f485649f52929d9937b346a920a522a7363e202 to before 886e28e14ab655012779016d251fef53d103aa12Affected 1f485649f52929d9937b346a920a522a7363e202 to before 11092d79eb2b7c0068382f72fc2416d1786bb2e0Affected 1f485649f52929d9937b346a920a522a7363e202 to before b6ea3dda09eb4d5caf7bbc00f857688cf9e98255Affected 1f485649f52929d9937b346a920a522a7363e202 to before ff04b26794a16a8a879eb4fd2c02c2d6b03850e9Affected
LinuxLinux	2.6.24Affected before 2.6.24Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1f485649f52929d9937b346a920a522a7363e202 to before 3d22a7da2e264f407c729f33a0a346ff76108bc6Affected
1f485649f52929d9937b346a920a522a7363e202 to before 6837c1c19a259518974cbc5a52017646e3906564Affected
1f485649f52929d9937b346a920a522a7363e202 to before 54bb4c03fa17cdcb157c26c33e60a78cf32960f5Affected
1f485649f52929d9937b346a920a522a7363e202 to before 5a365f1e423444c5da7eb689a8661633dad43e48Affected
1f485649f52929d9937b346a920a522a7363e202 to before 886e28e14ab655012779016d251fef53d103aa12Affected
1f485649f52929d9937b346a920a522a7363e202 to before 11092d79eb2b7c0068382f72fc2416d1786bb2e0Affected
1f485649f52929d9937b346a920a522a7363e202 to before b6ea3dda09eb4d5caf7bbc00f857688cf9e98255Affected
1f485649f52929d9937b346a920a522a7363e202 to before ff04b26794a16a8a879eb4fd2c02c2d6b03850e9Affected

LinuxLinux

2.6.24Affected
before 2.6.24Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.