{"id":"CVE-2026-68376","title":"sctp: fix auth_hmacs array size in struct sctp_cookie","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_hmacs array size in struct sctp_cookie\n\nThe auth_hmacs array in struct sctp_cookie is supposed to store a complete\nSCTP_AUTH_HMAC_ALGO parameter, which c…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 317731d01b03c529809df36d3a7d149677a8729d","Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 0528485f27016a42804abe01aa61b39d85fa803e","Linux >= 1f485649f52929d9937b346a920a522a7363e202 < ee5e65964f456adfe14d526fba0bd055de98ecf3","Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 0b4414e43e0861d67276031cc21401d7e87de3da","Linux >= 1f485649f52929d9937b346a920a522a7363e202 < d0a59ba58578e2b330fff80a44fe519f3ba7d8c7","Linux >= 1f485649f52929d9937b346a920a522a7363e202 < a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db","Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 3aa40c3bccac2312ea7cf97f329190637f972b5d","Linux >= 1f485649f52929d9937b346a920a522a7363e202 < e0b5252a59383b77d1b8dbeda00b7184dd95f4d3","Linux 2.6.24"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:47:35.941607Z"},"exploitAvailable":true,"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:09.967Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68376","references":[{"url":"https://git.kernel.org/stable/c/317731d01b03c529809df36d3a7d149677a8729d"},{"url":"https://git.kernel.org/stable/c/0528485f27016a42804abe01aa61b39d85fa803e"},{"url":"https://git.kernel.org/stable/c/ee5e65964f456adfe14d526fba0bd055de98ecf3"},{"url":"https://git.kernel.org/stable/c/0b4414e43e0861d67276031cc21401d7e87de3da"},{"url":"https://git.kernel.org/stable/c/d0a59ba58578e2b330fff80a44fe519f3ba7d8c7"},{"url":"https://git.kernel.org/stable/c/a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db"},{"url":"https://git.kernel.org/stable/c/3aa40c3bccac2312ea7cf97f329190637f972b5d"},{"url":"https://git.kernel.org/stable/c/e0b5252a59383b77d1b8dbeda00b7184dd95f4d3"}],"tags":["cve.org","exploit-available"],"epss":0.00495,"epssPercentile":0.41106,"exploits":{"github":1,"githubRepos":["https://github.com/gagaltotal/CVE-2026-68376-Ubuntu-7.0.0-30-Poc"],"checkedAt":"2026-10-16T17:25:21.017Z"},"ingestedAt":"2026-10-16T17:24:46.862Z","slug":"CVE-2026-68376","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_hmacs array size in struct sctp_cookie\n\nThe auth_hmacs array in struct sctp_cookie is supposed to store a complete\nSCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr\nfollowed by N HMAC identifiers.\n\nHowever, the array size was calculated using an extra 2 bytes instead of\nsizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers\nare configured, the HMAC-ALGO parameter stored in the endpoint is larger\nthan the auth_hmacs buffer in the cookie.\n\nAs a result, sctp_association_init() copies beyond the end of auth_hmacs\nwhen initializing the association, corrupting the adjacent auth_chunks\nfield. This can lead to an invalid HMAC identifier being accepted and later\ncause an out-of-bounds read in sctp_auth_get_hmac().\n\nFix the array size calculation by including the full SCTP parameter header\nsize.\n\n## Affected\n\n- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 317731d01b03c529809df36d3a7d149677a8729d`\n- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 0528485f27016a42804abe01aa61b39d85fa803e`\n- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < ee5e65964f456adfe14d526fba0bd055de98ecf3`\n- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 0b4414e43e0861d67276031cc21401d7e87de3da`\n- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < d0a59ba58578e2b330fff80a44fe519f3ba7d8c7`\n- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db`\n- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 3aa40c3bccac2312ea7cf97f329190637f972b5d`\n- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < e0b5252a59383b77d1b8dbeda00b7184dd95f4d3`\n- `Linux 2.6.24`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}