---
id: CVE-2026-68300
title: 'sctp: auth: verify auth requirement when auth_chunk is NULL'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sctp: auth: verify auth requirement when auth_chunk is NULL

  sctp_auth_chunk_verify() returns true unconditionally when
  chunk->auth_chunk is NULL, silently skipping aut…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-303
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e <
    a129792b3aef15002746c13522781d92ed3522c3
  - >-
    Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e <
    5a022ac51ad83b4ce6c898f4b9eefc65bd26b247
  - >-
    Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e <
    6caf0e8590c0bf05a76b0d387726adf3a6f3725c
  - >-
    Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e <
    ec2e157fc9678a9bc411305a25aec3fd337d7efb
  - >-
    Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e <
    28c5fdce9dd955d2baf5e28987819b6d7cfaf646
  - >-
    Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e <
    18957373920caf5cdaf5cf32e5d1d7a99ca7700a
  - >-
    Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e <
    83f5031f2a6a49d696eb4cc0898345d12f9c6451
  - >-
    Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e <
    8e04823c120b376ef7dab14b60ebf6823aa16c14
  - Linux 2.6.24
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:46:55.343274Z'
published: '2026-08-10'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T21:09:04.214Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68300'
references:
  - url: 'https://git.kernel.org/stable/c/a129792b3aef15002746c13522781d92ed3522c3'
  - url: 'https://git.kernel.org/stable/c/5a022ac51ad83b4ce6c898f4b9eefc65bd26b247'
  - url: 'https://git.kernel.org/stable/c/6caf0e8590c0bf05a76b0d387726adf3a6f3725c'
  - url: 'https://git.kernel.org/stable/c/ec2e157fc9678a9bc411305a25aec3fd337d7efb'
  - url: 'https://git.kernel.org/stable/c/28c5fdce9dd955d2baf5e28987819b6d7cfaf646'
  - url: 'https://git.kernel.org/stable/c/18957373920caf5cdaf5cf32e5d1d7a99ca7700a'
  - url: 'https://git.kernel.org/stable/c/83f5031f2a6a49d696eb4cc0898345d12f9c6451'
  - url: 'https://git.kernel.org/stable/c/8e04823c120b376ef7dab14b60ebf6823aa16c14'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68300.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-68300'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2513408'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-68300'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68300'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026081029-CVE-2026-68300-ab03@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:67150'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66325'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66324'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.0058
epssPercentile: 0.47521
patched:
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_8
  - enterprise_linux_baseos_v_9
  - enterprise_linux_crb_v_8
  - enterprise_linux_codeready_linux_builder_v_9
  - enterprise_linux_nfv_v_8
  - enterprise_linux_real_time_for_nfv_v_9
  - enterprise_linux_rt_v_8
  - enterprise_linux_real_time_v_9
scores:
  cna: 9.8
  vendor: 7
ingestedAt: '2026-10-16T17:24:46.856Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sctp: auth: verify auth requirement when auth_chunk is NULL

sctp_auth_chunk_verify() returns true unconditionally when
chunk->auth_chunk is NULL, silently skipping authentication.
This is incorrect when:

1. skb_clone() failed in the BH receive path, leaving auth_chunk
   NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new
   connections, so the early sctp_auth_recv_cid() check cannot
   catch this.

2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never
   called and auth_chunk remains NULL.

Fix by checking sctp_auth_recv_cid() when auth_chunk is NULL:
if authentication is required, return false to drop the chunk;
otherwise continue normally.

## Affected

- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < a129792b3aef15002746c13522781d92ed3522c3`
- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 5a022ac51ad83b4ce6c898f4b9eefc65bd26b247`
- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 6caf0e8590c0bf05a76b0d387726adf3a6f3725c`
- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < ec2e157fc9678a9bc411305a25aec3fd337d7efb`
- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 28c5fdce9dd955d2baf5e28987819b6d7cfaf646`
- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 18957373920caf5cdaf5cf32e5d1d7a99ca7700a`
- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 83f5031f2a6a49d696eb4cc0898345d12f9c6451`
- `Linux >= bbd0d59809f923ea2b540cbd781b32110e249f6e < 8e04823c120b376ef7dab14b60ebf6823aa16c14`
- `Linux 2.6.24`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:67150** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67150)
- **RHSA-2026:66325** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66325)
- **RHSA-2026:66324** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66324)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68300.json)