CVE-2026-68320 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, allowing it to hold up to 20 chunk entries (param_hdr.length up to 24). However, the copy destination asoc->c.auth_chunks in struct sctp_cookie is only SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16 chunks are added, sctp_association_init() memcpy overflows the destination by up to 4 bytes.
Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability exists within the Stream Control Transmission Protocol implementation in the Linux kernel where a buffer overflow occurs during authentication chunk list handling. This issue affects the sctp_auth_ep_add_chunkid function which incorrectly uses SCTP_NUM_CHUNK_TYPES (20) as the maximum capacity for endpoint authentication chunk lists instead of the actual destination capacity of SCTP_AUTH_MAX_CHUNKS (16). The mismatch creates a scenario where the system can attempt to store more authentication chunks than the allocated memory space can accommodate, leading to potential memory corruption.
The technical flaw stems from an inadequate bounds checking mechanism within the SCTP authentication framework. When more than 16 authentication chunks are added to the endpoint's auth_chunk_list, the subsequent sctp_association_init() function performs a memcpy operation that overflows the destination buffer in struct sctp_cookie. This overflow occurs because the copy destination asoc->c.auth_chunks is specifically allocated to hold only 16 entries of 20 bytes each, while the source can potentially contain up to 20 entries. The discrepancy allows for up to 4 additional bytes to be written beyond the intended buffer boundaries.
This vulnerability represents a classic buffer overflow condition that can lead to arbitrary code execution or system instability. The issue directly maps to CWE-121 Stack-based Buffer Overflow and CWE-787 Out-of-bounds Write, both of which are critical security concerns in kernel space operations. The operational impact includes potential denial of service attacks where malicious actors could trigger the overflow condition through crafted SCTP packets, or more severe exploitation scenarios that might allow privilege escalation within the kernel context.
The mitigation strategy involves implementing proper capacity checks that align the source and destination buffer sizes for authentication chunk lists. By changing the function to use SCTP_AUTH_MAX_CHUNKS as the capacity limit instead of SCTP_NUM_CHUNK_TYPES, the system ensures that the endpoint authentication chunk list never exceeds the actual storage capacity in the association cookie structure. This fix aligns with ATT&CK technique T1068 Exploitation for Privilege Escalation and addresses the fundamental mismatch between allocation and usage patterns in kernel memory management. The resolution maintains backward compatibility while preventing the overflow condition that could be exploited by attackers to compromise system integrity.
The vulnerability demonstrates the importance of careful buffer management in kernel space programming where assumptions about data structures can lead to critical security flaws. Proper input validation and capacity checking mechanisms are essential when dealing with network protocol implementations that handle variable-length data structures. This fix reinforces defensive programming practices that should be applied throughout kernel subsystems to prevent similar issues in other network protocol implementations.