CVE-2026-68300

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68300", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.380Z", "datePublished": "2026-08-10T12:02:34.168Z", "dateUpdated": "2026-10-19T21:09:04.214Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:32:51.209Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: auth: verify auth requirement when auth_chunk is NULL\n\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk->auth_chunk is NULL, silently skipping authentication.\nThis is incorrect when:\n\n1. skb_clone() failed in the BH receive path, leaving auth_chunk\n NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new\n connections, so the early sctp_auth_recv_cid() check cannot\n catch this.\n\n2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never\n called and auth_chunk remains NULL.\n\nFix by checking sctp_auth_recv_cid() when auth_chunk is NULL:\nif authentication is required, return false to drop the chunk;\notherwise continue normally."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is SCTP COOKIE-ECHO chunk processing in the kernel's SCTP state machine, reached directly from packets received on the network from any remote peer over an arbitrarily routed SCTP connection.\nAC:L - The attacker deterministically triggers the bypass by completing a normal INIT/INIT-ACK exchange with the AUTH extension advertised and then sending COOKIE-ECHO with no preceding AUTH chunk; no race, no memory-layout dependency, and every step is under the attacker's control.\nPR:N - This is the pre-authentication association-establishment path itself; the attacker needs no credentials, no shared SCTP-AUTH key, and no account, since the bug is precisely that the required authentication is skipped.\nUI:N - The listening SCTP endpoint processes the crafted COOKIE-ECHO automatically in the receive path; no action by any local user or administrator is needed.\nS:U - The bypass affects the SCTP association and the application relying on it within the same host security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An unauthenticated peer is admitted as an apparently authenticated one, and because peer.auth_capable is set the SCTP_AUTH_NO_AUTH notification is suppressed so the application cannot detect it, giving the attacker full read access to all data the service sends on that association.\nI:H - The attacker can inject arbitrary SCTP data and control chunks into the service as a trusted, supposedly key-verified peer, and can use the dupcook restart path to update or replace an existing association's state without authentication.\nA:H - Authenticating COOKIE-ECHO is the RFC 4895 defense against unauthorized association restart; bypassing it lets an attacker reset/take over an established association, dropping its queued state and denying service to the legitimate peer, and lets unauthorized peers consume association and accept-queue resources on an endpoint meant to admit only key-holding peers."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/sm_statefuns.c"], "versions": [{"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "a129792b3aef15002746c13522781d92ed3522c3", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "5a022ac51ad83b4ce6c898f4b9eefc65bd26b247", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "6caf0e8590c0bf05a76b0d387726adf3a6f3725c", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "ec2e157fc9678a9bc411305a25aec3fd337d7efb", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "28c5fdce9dd955d2baf5e28987819b6d7cfaf646", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "18957373920caf5cdaf5cf32e5d1d7a99ca7700a", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "83f5031f2a6a49d696eb4cc0898345d12f9c6451", "status": "affected", "versionType": "git"}, {"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "8e04823c120b376ef7dab14b60ebf6823aa16c14", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/sm_statefuns.c"], "versions": [{"version": "2.6.24", "status": "affected"}, {"version": "0", "lessThan": "2.6.24", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a129792b3aef15002746c13522781d92ed3522c3"}, {"url": "https://git.kernel.org/stable/c/5a022ac51ad83b4ce6c898f4b9eefc65bd26b247"}, {"url": "https://git.kernel.org/stable/c/6caf0e8590c0bf05a76b0d387726adf3a6f3725c"}, {"url": "https://git.kernel.org/stable/c/ec2e157fc9678a9bc411305a25aec3fd337d7efb"}, {"url": "https://git.kernel.org/stable/c/28c5fdce9dd955d2baf5e28987819b6d7cfaf646"}, {"url": "https://git.kernel.org/stable/c/18957373920caf5cdaf5cf32e5d1d7a99ca7700a"}, {"url": "https://git.kernel.org/stable/c/83f5031f2a6a49d696eb4cc0898345d12f9c6451"}, {"url": "https://git.kernel.org/stable/c/8e04823c120b376ef7dab14b60ebf6823aa16c14"}], "title": "sctp: auth: verify auth requirement when auth_chunk is NULL", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68300", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:46:55.343274Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T21:09:04.214Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68300", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:46:55.343274Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:46:55.902Z"}}], "cna": {"title": "sctp: auth: verify auth requirement when auth_chunk is NULL", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is SCTP COOKIE-ECHO chunk processing in the kernel's SCTP state machine, reached directly from packets received on the network from any remote peer over an arbitrarily routed SCTP connection.\nAC:L - The attacker deterministically triggers the bypass by completing a normal INIT/INIT-ACK exchange with the AUTH extension advertised and then sending COOKIE-ECHO with no preceding AUTH chunk; no race, no memory-layout dependency, and every step is under the attacker's control.\nPR:N - This is the pre-authentication association-establishment path itself; the attacker needs no credentials, no shared SCTP-AUTH key, and no account, since the bug is precisely that the required authentication is skipped.\nUI:N - The listening SCTP endpoint processes the crafted COOKIE-ECHO automatically in the receive path; no action by any local user or administrator is needed.\nS:U - The bypass affects the SCTP association and the application relying on it within the same host security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An unauthenticated peer is admitted as an apparently authenticated one, and because peer.auth_capable is set the SCTP_AUTH_NO_AUTH notification is suppressed so the application cannot detect it, giving the attacker full read access to all data the service sends on that association.\nI:H - The attacker can inject arbitrary SCTP data and control chunks into the service as a trusted, supposedly key-verified peer, and can use the dupcook restart path to update or replace an existing association's state without authentication.\nA:H - Authenticating COOKIE-ECHO is the RFC 4895 defense against unauthorized association restart; bypassing it lets an attacker reset/take over an established association, dropping its queued state and denying service to the legitimate peer, and lets unauthorized peers consume association and accept-queue resources on an endpoint meant to admit only key-holding peers."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "a129792b3aef15002746c13522781d92ed3522c3", "versionType": "git"}, {"status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "5a022ac51ad83b4ce6c898f4b9eefc65bd26b247", "versionType": "git"}, {"status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "6caf0e8590c0bf05a76b0d387726adf3a6f3725c", "versionType": "git"}, {"status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "ec2e157fc9678a9bc411305a25aec3fd337d7efb", "versionType": "git"}, {"status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "28c5fdce9dd955d2baf5e28987819b6d7cfaf646", "versionType": "git"}, {"status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "18957373920caf5cdaf5cf32e5d1d7a99ca7700a", "versionType": "git"}, {"status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "83f5031f2a6a49d696eb4cc0898345d12f9c6451", "versionType": "git"}, {"status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "lessThan": "8e04823c120b376ef7dab14b60ebf6823aa16c14", "versionType": "git"}], "programFiles": ["net/sctp/sm_statefuns.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.24"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.24", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sctp/sm_statefuns.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a129792b3aef15002746c13522781d92ed3522c3"}, {"url": "https://git.kernel.org/stable/c/5a022ac51ad83b4ce6c898f4b9eefc65bd26b247"}, {"url": "https://git.kernel.org/stable/c/6caf0e8590c0bf05a76b0d387726adf3a6f3725c"}, {"url": "https://git.kernel.org/stable/c/ec2e157fc9678a9bc411305a25aec3fd337d7efb"}, {"url": "https://git.kernel.org/stable/c/28c5fdce9dd955d2baf5e28987819b6d7cfaf646"}, {"url": "https://git.kernel.org/stable/c/18957373920caf5cdaf5cf32e5d1d7a99ca7700a"}, {"url": "https://git.kernel.org/stable/c/83f5031f2a6a49d696eb4cc0898345d12f9c6451"}, {"url": "https://git.kernel.org/stable/c/8e04823c120b376ef7dab14b60ebf6823aa16c14"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: auth: verify auth requirement when auth_chunk is NULL\n\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk->auth_chunk is NULL, silently skipping authentication.\nThis is incorrect when:\n\n1. skb_clone() failed in the BH receive path, leaving auth_chunk\n NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new\n connections, so the early sctp_auth_recv_cid() check cannot\n catch this.\n\n2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never\n called and auth_chunk remains NULL.\n\nFix by checking sctp_auth_recv_cid() when auth_chunk is NULL:\nif authentication is required, return false to drop the chunk;\notherwise continue normally."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "2.6.24"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "2.6.24"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "2.6.24"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.148", "versionStartIncluding": "2.6.24"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.101", "versionStartIncluding": "2.6.24"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.42", "versionStartIncluding": "2.6.24"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.6", "versionStartIncluding": "2.6.24"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "2.6.24"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:32:51.209Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68300", "state": "PUBLISHED", "dateUpdated": "2026-10-19T21:09:04.214Z", "dateReserved": "2026-07-30T09:28:09.380Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-10T12:02:34.168Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sctp/sm_statefuns.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a129792b3aef15002746c13522781d92ed3522c3", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "5a022ac51ad83b4ce6c898f4b9eefc65bd26b247", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "6caf0e8590c0bf05a76b0d387726adf3a6f3725c", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "ec2e157fc9678a9bc411305a25aec3fd337d7efb", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "28c5fdce9dd955d2baf5e28987819b6d7cfaf646", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "18957373920caf5cdaf5cf32e5d1d7a99ca7700a", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "83f5031f2a6a49d696eb4cc0898345d12f9c6451", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}, {"lessThan": "8e04823c120b376ef7dab14b60ebf6823aa16c14", "status": "affected", "version": "bbd0d59809f923ea2b540cbd781b32110e249f6e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sctp/sm_statefuns.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.24"}, {"lessThan": "2.6.24", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: auth: verify auth requirement when auth_chunk is NULL\n\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk->auth_chunk is NULL, silently skipping authentication.\nThis is incorrect when:\n\n1. skb_clone() failed in the BH receive path, leaving auth_chunk\n NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new\n connections, so the early sctp_auth_recv_cid() check cannot\n catch this.\n\n2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never\n called and auth_chunk remains NULL.\n\nFix by checking sctp_auth_recv_cid() when auth_chunk is NULL:\nif authentication is required, return false to drop the chunk;\notherwise continue normally."}], "id": "CVE-2026-68300", "lastModified": "2026-10-19T22:17:12.530", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68300", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:46:55.343274Z", "version": "2.0.3"}}]}, "published": "2026-08-10T13:20:19.560", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/18957373920caf5cdaf5cf32e5d1d7a99ca7700a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/28c5fdce9dd955d2baf5e28987819b6d7cfaf646"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5a022ac51ad83b4ce6c898f4b9eefc65bd26b247"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6caf0e8590c0bf05a76b0d387726adf3a6f3725c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/83f5031f2a6a49d696eb4cc0898345d12f9c6451"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8e04823c120b376ef7dab14b60ebf6823aa16c14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a129792b3aef15002746c13522781d92ed3522c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec2e157fc9678a9bc411305a25aec3fd337d7efb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: sctp: auth: verify auth requirement when auth_chunk is NULL", "id": "2513408", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513408"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-303", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsctp: auth: verify auth requirement when auth_chunk is NULL\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk->auth_chunk is NULL, silently skipping authentication.\nThis is incorrect when:\n1. skb_clone() failed in the BH receive path, leaving auth_chunk\nNULL. In sctp_endpoint_bh_rcv() asoc is NULL for new\nconnections, so the early sctp_auth_recv_cid() check cannot\ncatch this.\n2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never\ncalled and auth_chunk remains NULL.\nFix by checking sctp_auth_recv_cid() when auth_chunk is NULL:\nif authentication is required, return false to drop the chunk;\notherwise continue normally.", "A flaw was found in the Stream Control Transmission Protocol (SCTP) authentication mechanism within the Linux kernel. The `sctp_auth_chunk_verify()` function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific conditions, such as when memory allocation fails or when an authentication chunk is missing before a COOKIE-ECHO message. An attacker could potentially exploit this to bypass intended security controls."], "name": "CVE-2026-68300", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68300\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68300\nhttps://lore.kernel.org/linux-cve-announce/2026081029-CVE-2026-68300-ab03@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,ec2e157fc9678a9bc411305a25aec3fd337d7efb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,28c5fdce9dd955d2baf5e28987819b6d7cfaf646)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,18957373920caf5cdaf5cf32e5d1d7a99ca7700a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,83f5031f2a6a49d696eb4cc0898345d12f9c6451)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bbd0d59809f923ea2b540cbd781b32110e249f6e,8e04823c120b376ef7dab14b60ebf6823aa16c14)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.24"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.24)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T15:30:05.871790+00:00", "updated": "2026-10-20T10:45:13.781182+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}