---
id: CVE-2026-68320
title: 'sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

  sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the
  capacity limit for ep->auth_chunk…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1f485649f52929d9937b346a920a522a7363e202 <
    3d22a7da2e264f407c729f33a0a346ff76108bc6
  - >-
    Linux >= 1f485649f52929d9937b346a920a522a7363e202 <
    6837c1c19a259518974cbc5a52017646e3906564
  - >-
    Linux >= 1f485649f52929d9937b346a920a522a7363e202 <
    54bb4c03fa17cdcb157c26c33e60a78cf32960f5
  - >-
    Linux >= 1f485649f52929d9937b346a920a522a7363e202 <
    5a365f1e423444c5da7eb689a8661633dad43e48
  - >-
    Linux >= 1f485649f52929d9937b346a920a522a7363e202 <
    886e28e14ab655012779016d251fef53d103aa12
  - >-
    Linux >= 1f485649f52929d9937b346a920a522a7363e202 <
    11092d79eb2b7c0068382f72fc2416d1786bb2e0
  - >-
    Linux >= 1f485649f52929d9937b346a920a522a7363e202 <
    b6ea3dda09eb4d5caf7bbc00f857688cf9e98255
  - >-
    Linux >= 1f485649f52929d9937b346a920a522a7363e202 <
    ff04b26794a16a8a879eb4fd2c02c2d6b03850e9
  - Linux 2.6.24
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:47:04.682572Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:07.878Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68320'
references:
  - url: 'https://git.kernel.org/stable/c/3d22a7da2e264f407c729f33a0a346ff76108bc6'
  - url: 'https://git.kernel.org/stable/c/6837c1c19a259518974cbc5a52017646e3906564'
  - url: 'https://git.kernel.org/stable/c/54bb4c03fa17cdcb157c26c33e60a78cf32960f5'
  - url: 'https://git.kernel.org/stable/c/5a365f1e423444c5da7eb689a8661633dad43e48'
  - url: 'https://git.kernel.org/stable/c/886e28e14ab655012779016d251fef53d103aa12'
  - url: 'https://git.kernel.org/stable/c/11092d79eb2b7c0068382f72fc2416d1786bb2e0'
  - url: 'https://git.kernel.org/stable/c/b6ea3dda09eb4d5caf7bbc00f857688cf9e98255'
  - url: 'https://git.kernel.org/stable/c/ff04b26794a16a8a879eb4fd2c02c2d6b03850e9'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.02147
ingestedAt: '2026-10-16T17:24:46.857Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the
capacity limit for ep->auth_chunk_list, allowing it to hold up to
20 chunk entries (param_hdr.length up to 24). However, the copy
destination asoc->c.auth_chunks in struct sctp_cookie is only
SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16
chunks are added, sctp_association_init() memcpy overflows the
destination by up to 4 bytes.

Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching
the destination capacity.

## Affected

- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 3d22a7da2e264f407c729f33a0a346ff76108bc6`
- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 6837c1c19a259518974cbc5a52017646e3906564`
- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 54bb4c03fa17cdcb157c26c33e60a78cf32960f5`
- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 5a365f1e423444c5da7eb689a8661633dad43e48`
- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 886e28e14ab655012779016d251fef53d103aa12`
- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < 11092d79eb2b7c0068382f72fc2416d1786bb2e0`
- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < b6ea3dda09eb4d5caf7bbc00f857688cf9e98255`
- `Linux >= 1f485649f52929d9937b346a920a522a7363e202 < ff04b26794a16a8a879eb4fd2c02c2d6b03850e9`
- `Linux 2.6.24`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.