{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68300","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.380Z","datePublished":"2026-08-10T12:02:34.168Z","dateUpdated":"2026-08-19T16:32:51.209Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-19T16:32:51.209Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: auth: verify auth requirement when auth_chunk is NULL\n\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk->auth_chunk is NULL, silently skipping authentication.\nThis is incorrect when:\n\n1. skb_clone() failed in the BH receive path, leaving auth_chunk\n   NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new\n   connections, so the early sctp_auth_recv_cid() check cannot\n   catch this.\n\n2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never\n   called and auth_chunk remains NULL.\n\nFix by checking sctp_auth_recv_cid() when auth_chunk is NULL:\nif authentication is required, return false to drop the chunk;\notherwise continue normally."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is SCTP COOKIE-ECHO chunk processing in the kernel's SCTP state machine, reached directly from packets received on the network from any remote peer over an arbitrarily routed SCTP connection.\nAC:L - The attacker deterministically triggers the bypass by completing a normal INIT/INIT-ACK exchange with the AUTH extension advertised and then sending COOKIE-ECHO with no preceding AUTH chunk; no race, no memory-layout dependency, and every step is under the attacker's control.\nPR:N - This is the pre-authentication association-establishment path itself; the attacker needs no credentials, no shared SCTP-AUTH key, and no account, since the bug is precisely that the required authentication is skipped.\nUI:N - The listening SCTP endpoint processes the crafted COOKIE-ECHO automatically in the receive path; no action by any local user or administrator is needed.\nS:U - The bypass affects the SCTP association and the application relying on it within the same host security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An unauthenticated peer is admitted as an apparently authenticated one, and because peer.auth_capable is set the SCTP_AUTH_NO_AUTH notification is suppressed so the application cannot detect it, giving the attacker full read access to all data the service sends on that association.\nI:H - The attacker can inject arbitrary SCTP data and control chunks into the service as a trusted, supposedly key-verified peer, and can use the dupcook restart path to update or replace an existing association's state without authentication.\nA:H - Authenticating COOKIE-ECHO is the RFC 4895 defense against unauthorized association restart; bypassing it lets an attacker reset/take over an established association, dropping its queued state and denying service to the legitimate peer, and lets unauthorized peers consume association and accept-queue resources on an endpoint meant to admit only key-holding peers."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_statefuns.c"],"versions":[{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","lessThan":"a129792b3aef15002746c13522781d92ed3522c3","status":"affected","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","lessThan":"5a022ac51ad83b4ce6c898f4b9eefc65bd26b247","status":"affected","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","lessThan":"6caf0e8590c0bf05a76b0d387726adf3a6f3725c","status":"affected","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","lessThan":"ec2e157fc9678a9bc411305a25aec3fd337d7efb","status":"affected","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","lessThan":"28c5fdce9dd955d2baf5e28987819b6d7cfaf646","status":"affected","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","lessThan":"18957373920caf5cdaf5cf32e5d1d7a99ca7700a","status":"affected","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","lessThan":"83f5031f2a6a49d696eb4cc0898345d12f9c6451","status":"affected","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","lessThan":"8e04823c120b376ef7dab14b60ebf6823aa16c14","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_statefuns.c"],"versions":[{"version":"2.6.24","status":"affected"},{"version":"0","lessThan":"2.6.24","status":"unaffected","versionType":"semver"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a129792b3aef15002746c13522781d92ed3522c3"},{"url":"https://git.kernel.org/stable/c/5a022ac51ad83b4ce6c898f4b9eefc65bd26b247"},{"url":"https://git.kernel.org/stable/c/6caf0e8590c0bf05a76b0d387726adf3a6f3725c"},{"url":"https://git.kernel.org/stable/c/ec2e157fc9678a9bc411305a25aec3fd337d7efb"},{"url":"https://git.kernel.org/stable/c/28c5fdce9dd955d2baf5e28987819b6d7cfaf646"},{"url":"https://git.kernel.org/stable/c/18957373920caf5cdaf5cf32e5d1d7a99ca7700a"},{"url":"https://git.kernel.org/stable/c/83f5031f2a6a49d696eb4cc0898345d12f9c6451"},{"url":"https://git.kernel.org/stable/c/8e04823c120b376ef7dab14b60ebf6823aa16c14"}],"title":"sctp: auth: verify auth requirement when auth_chunk is NULL","x_generator":{"engine":"bippy-1.2.0"}}}}