{"id":"CVE-2026-68300","title":"sctp: auth: verify auth requirement when auth_chunk is NULL","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: auth: verify auth requirement when auth_chunk is NULL\n\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk->auth_chunk is NULL, silently skipping aut…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-303"],"vendor":"Linux","product":"Linux","affected":["Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < a129792b3aef15002746c13522781d92ed3522c3","Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 5a022ac51ad83b4ce6c898f4b9eefc65bd26b247","Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 6caf0e8590c0bf05a76b0d387726adf3a6f3725c","Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < ec2e157fc9678a9bc411305a25aec3fd337d7efb","Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 28c5fdce9dd955d2baf5e28987819b6d7cfaf646","Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 18957373920caf5cdaf5cf32e5d1d7a99ca7700a","Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 83f5031f2a6a49d696eb4cc0898345d12f9c6451","Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 8e04823c120b376ef7dab14b60ebf6823aa16c14","Linux 2.6.24"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:46:55.343274Z"},"published":"2026-08-10","updated":"2026-10-19","sourceUpdated":"2026-10-19T21:09:04.214Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68300","references":[{"url":"https://git.kernel.org/stable/c/a129792b3aef15002746c13522781d92ed3522c3"},{"url":"https://git.kernel.org/stable/c/5a022ac51ad83b4ce6c898f4b9eefc65bd26b247"},{"url":"https://git.kernel.org/stable/c/6caf0e8590c0bf05a76b0d387726adf3a6f3725c"},{"url":"https://git.kernel.org/stable/c/ec2e157fc9678a9bc411305a25aec3fd337d7efb"},{"url":"https://git.kernel.org/stable/c/28c5fdce9dd955d2baf5e28987819b6d7cfaf646"},{"url":"https://git.kernel.org/stable/c/18957373920caf5cdaf5cf32e5d1d7a99ca7700a"},{"url":"https://git.kernel.org/stable/c/83f5031f2a6a49d696eb4cc0898345d12f9c6451"},{"url":"https://git.kernel.org/stable/c/8e04823c120b376ef7dab14b60ebf6823aa16c14"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68300.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-68300"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2513408"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68300"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68300"},{"url":"https://lore.kernel.org/linux-cve-announce/2026081029-CVE-2026-68300-ab03@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:67150"},{"url":"https://access.redhat.com/errata/RHSA-2026:66325"},{"url":"https://access.redhat.com/errata/RHSA-2026:66324"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.0058,"epssPercentile":0.47521,"patched":["enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_8","enterprise_linux_baseos_v_9","enterprise_linux_crb_v_8","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_nfv_v_8","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_rt_v_8","enterprise_linux_real_time_v_9"],"scores":{"cna":9.8,"vendor":7},"ingestedAt":"2026-10-16T17:24:46.856Z","slug":"CVE-2026-68300","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: auth: verify auth requirement when auth_chunk is NULL\n\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk->auth_chunk is NULL, silently skipping authentication.\nThis is incorrect when:\n\n1. skb_clone() failed in the BH receive path, leaving auth_chunk\n   NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new\n   connections, so the early sctp_auth_recv_cid() check cannot\n   catch this.\n\n2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never\n   called and auth_chunk remains NULL.\n\nFix by checking sctp_auth_recv_cid() when auth_chunk is NULL:\nif authentication is required, return false to drop the chunk;\notherwise continue normally.\n\n## Affected\n\n- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < a129792b3aef15002746c13522781d92ed3522c3`\n- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 5a022ac51ad83b4ce6c898f4b9eefc65bd26b247`\n- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 6caf0e8590c0bf05a76b0d387726adf3a6f3725c`\n- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < ec2e157fc9678a9bc411305a25aec3fd337d7efb`\n- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 28c5fdce9dd955d2baf5e28987819b6d7cfaf646`\n- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 18957373920caf5cdaf5cf32e5d1d7a99ca7700a`\n- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 83f5031f2a6a49d696eb4cc0898345d12f9c6451`\n- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 8e04823c120b376ef7dab14b60ebf6823aa16c14`\n- `Linux 2.6.24`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:67150** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67150)\n- **RHSA-2026:66325** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66325)\n- **RHSA-2026:66324** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66324)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68300.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":225245,"id":"CVE-2026-68300","ts":1792446329758,"field":"cvss","old":"7","new":"9.8"},{"seq":225244,"id":"CVE-2026-68300","ts":1792446329758,"field":"severity","old":"high","new":"critical"},{"seq":223655,"id":"CVE-2026-68300","ts":1792238349804,"field":"cvss","old":"9.8","new":"7"},{"seq":223654,"id":"CVE-2026-68300","ts":1792238349804,"field":"severity","old":"critical","new":"high"}]}