{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68376", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.386Z", "datePublished": "2026-08-10T12:03:54.666Z", "dateUpdated": "2026-08-19T16:34:35.759Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:34:35.759Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_hmacs array size in struct sctp_cookie\n\nThe auth_hmacs array in struct sctp_cookie is supposed to store a complete\nSCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr\nfollowed by N HMAC identifiers.\n\nHowever, the array size was calculated using an extra 2 bytes instead of\nsizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers\nare configured, the HMAC-ALGO parameter stored in the endpoint is larger\nthan the auth_hmacs buffer in the cookie.\n\nAs a result, sctp_association_init() copies beyond the end of auth_hmacs\nwhen initializing the association, corrupting the adjacent auth_chunks\nfield. This can lead to an invalid HMAC identifier being accepted and later\ncause an out-of-bounds read in sctp_auth_get_hmac().\n\nFix the array size calculation by including the full SCTP parameter header\nsize."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The out-of-bounds index is taken directly from the `hmac_id` field of an AUTH chunk received from a remote SCTP peer and processed in sctp_sf_eat_auth()/sctp_sf_authenticate(), which is the normal SCTP packet-receive path in net/sctp.\nAC:H - The overflow only occurs when the victim endpoint was configured with exactly four HMAC identifiers via setsockopt(SCTP_HMAC_IDENT); three or fewer fit the buffer exactly. That local socket configuration is beyond a remote attacker's control, though a local user can arrange it and then attack over loopback.\nPR:N - Once the endpoint is so configured, any peer that completes an ordinary SCTP handshake can send the malformed AUTH chunk; the bogus hmac_id is accepted and dereferenced before any shared-key or HMAC verification, so no credentials of any kind are needed.\nUI:N - The AUTH chunk is consumed automatically by the kernel SCTP state machine on packet receipt; no action by any local user or administrator is needed at attack time.\nS:U - The corruption and the subsequent out-of-bounds accesses are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - sctp_auth_get_hmac() reads far past the 4-entry sctp_hmac_list, and on kernels before the HMAC library conversion sctp_auth_calculate_hmac() reads a function-table pointer ~262 KB beyond the 4-pointer ep->auth_hmacs heap array; the accepted/rejected signature length acts as an oracle leaking the out-of-bounds value.\nI:H - The wild crypto_shash pointer fetched out of bounds is passed straight to crypto_shash_setkey()/crypto_shash_tfm_digest(), giving an attacker-groomable indirect call and write target; on current kernels a fixed 32-byte HMAC is written into a digest area sized from out-of-bounds data.\nA:H - Dereferencing an out-of-bounds heap pointer as a crypto transform, or writing a 32-byte digest into an undersized skb region, reliably oopses or panics the kernel, and the attack can be repeated on every association."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sctp/structs.h"], "versions": [{"version": "1f485649f52929d9937b346a920a522a7363e202", "lessThan": "317731d01b03c529809df36d3a7d149677a8729d", "status": "affected", "versionType": "git"}, {"version": "1f485649f52929d9937b346a920a522a7363e202", "lessThan": "0528485f27016a42804abe01aa61b39d85fa803e", "status": "affected", "versionType": "git"}, {"version": "1f485649f52929d9937b346a920a522a7363e202", "lessThan": "ee5e65964f456adfe14d526fba0bd055de98ecf3", "status": "affected", "versionType": "git"}, {"version": "1f485649f52929d9937b346a920a522a7363e202", "lessThan": "0b4414e43e0861d67276031cc21401d7e87de3da", "status": "affected", "versionType": "git"}, {"version": "1f485649f52929d9937b346a920a522a7363e202", "lessThan": "d0a59ba58578e2b330fff80a44fe519f3ba7d8c7", "status": "affected", "versionType": "git"}, {"version": "1f485649f52929d9937b346a920a522a7363e202", "lessThan": "a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db", "status": "affected", "versionType": "git"}, {"version": "1f485649f52929d9937b346a920a522a7363e202", "lessThan": "3aa40c3bccac2312ea7cf97f329190637f972b5d", "status": "affected", "versionType": "git"}, {"version": "1f485649f52929d9937b346a920a522a7363e202", "lessThan": "e0b5252a59383b77d1b8dbeda00b7184dd95f4d3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sctp/structs.h"], "versions": [{"version": "2.6.24", "status": "affected"}, {"version": "0", "lessThan": "2.6.24", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/317731d01b03c529809df36d3a7d149677a8729d"}, {"url": "https://git.kernel.org/stable/c/0528485f27016a42804abe01aa61b39d85fa803e"}, {"url": "https://git.kernel.org/stable/c/ee5e65964f456adfe14d526fba0bd055de98ecf3"}, {"url": "https://git.kernel.org/stable/c/0b4414e43e0861d67276031cc21401d7e87de3da"}, {"url": "https://git.kernel.org/stable/c/d0a59ba58578e2b330fff80a44fe519f3ba7d8c7"}, {"url": "https://git.kernel.org/stable/c/a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db"}, {"url": "https://git.kernel.org/stable/c/3aa40c3bccac2312ea7cf97f329190637f972b5d"}, {"url": "https://git.kernel.org/stable/c/e0b5252a59383b77d1b8dbeda00b7184dd95f4d3"}], "title": "sctp: fix auth_hmacs array size in struct sctp_cookie", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/sctp/structs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "317731d01b03c529809df36d3a7d149677a8729d", "status": "affected", "version": "1f485649f52929d9937b346a920a522a7363e202", "versionType": "git"}, {"lessThan": "0528485f27016a42804abe01aa61b39d85fa803e", "status": "affected", "version": "1f485649f52929d9937b346a920a522a7363e202", "versionType": "git"}, {"lessThan": "ee5e65964f456adfe14d526fba0bd055de98ecf3", "status": "affected", "version": "1f485649f52929d9937b346a920a522a7363e202", "versionType": "git"}, {"lessThan": "0b4414e43e0861d67276031cc21401d7e87de3da", "status": "affected", "version": "1f485649f52929d9937b346a920a522a7363e202", "versionType": "git"}, {"lessThan": "d0a59ba58578e2b330fff80a44fe519f3ba7d8c7", "status": "affected", "version": "1f485649f52929d9937b346a920a522a7363e202", "versionType": "git"}, {"lessThan": "a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db", "status": "affected", "version": "1f485649f52929d9937b346a920a522a7363e202", "versionType": "git"}, {"lessThan": "3aa40c3bccac2312ea7cf97f329190637f972b5d", "status": "affected", "version": "1f485649f52929d9937b346a920a522a7363e202", "versionType": "git"}, {"lessThan": "e0b5252a59383b77d1b8dbeda00b7184dd95f4d3", "status": "affected", "version": "1f485649f52929d9937b346a920a522a7363e202", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/sctp/structs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.24"}, {"lessThan": "2.6.24", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_hmacs array size in struct sctp_cookie\n\nThe auth_hmacs array in struct sctp_cookie is supposed to store a complete\nSCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr\nfollowed by N HMAC identifiers.\n\nHowever, the array size was calculated using an extra 2 bytes instead of\nsizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers\nare configured, the HMAC-ALGO parameter stored in the endpoint is larger\nthan the auth_hmacs buffer in the cookie.\n\nAs a result, sctp_association_init() copies beyond the end of auth_hmacs\nwhen initializing the association, corrupting the adjacent auth_chunks\nfield. This can lead to an invalid HMAC identifier being accepted and later\ncause an out-of-bounds read in sctp_auth_get_hmac().\n\nFix the array size calculation by including the full SCTP parameter header\nsize."}], "id": "CVE-2026-68376", "lastModified": "2026-08-19T17:20:46.923", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:30.530", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0528485f27016a42804abe01aa61b39d85fa803e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b4414e43e0861d67276031cc21401d7e87de3da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/317731d01b03c529809df36d3a7d149677a8729d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3aa40c3bccac2312ea7cf97f329190637f972b5d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0a59ba58578e2b330fff80a44fe519f3ba7d8c7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e0b5252a59383b77d1b8dbeda00b7184dd95f4d3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ee5e65964f456adfe14d526fba0bd055de98ecf3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel SCTP: Out-of-bounds read due to incorrect array size calculation", "id": "2513253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513253"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsctp: fix auth_hmacs array size in struct sctp_cookie\nThe auth_hmacs array in struct sctp_cookie is supposed to store a complete\nSCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr\nfollowed by N HMAC identifiers.\nHowever, the array size was calculated using an extra 2 bytes instead of\nsizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers\nare configured, the HMAC-ALGO parameter stored in the endpoint is larger\nthan the auth_hmacs buffer in the cookie.\nAs a result, sctp_association_init() copies beyond the end of auth_hmacs\nwhen initializing the association, corrupting the adjacent auth_chunks\nfield. This can lead to an invalid HMAC identifier being accepted and later\ncause an out-of-bounds read in sctp_auth_get_hmac().\nFix the array size calculation by including the full SCTP parameter header\nsize.", "A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. An incorrect array size calculation for the `auth_hmacs` field within the `sctp_cookie` structure could lead to a buffer overflow. During the initialization of an SCTP association, if four HMAC identifiers are configured, the system attempts to copy data beyond the allocated buffer. This results in the corruption of an adjacent memory field (`auth_chunks`) and can subsequently cause an out-of-bounds read when processing HMAC identifiers."], "name": "CVE-2026-68376", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:03:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68376\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68376\nhttps://git.kernel.org/stable/c/0b4414e43e0861d67276031cc21401d7e87de3da\nhttps://git.kernel.org/stable/c/3aa40c3bccac2312ea7cf97f329190637f972b5d\nhttps://git.kernel.org/stable/c/a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db\nhttps://git.kernel.org/stable/c/d0a59ba58578e2b330fff80a44fe519f3ba7d8c7\nhttps://git.kernel.org/stable/c/e0b5252a59383b77d1b8dbeda00b7184dd95f4d3"], "threat_severity": "Important"}