CVE-2026-68315High· 7.5▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctp_process_strreset_inreq() When processing a RESET_IN_REQUEST from a peer, sctp_process_strreset_inreq() derives the stream count fro…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Last analysed / modified upstream
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate stream count in sctp_process_strreset_inreq()
When processing a RESET_IN_REQUEST from a peer, sctp_process_strreset_inreq() derives the stream count from the parameter length but does not check whether the resulting RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN.
The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes larger than the IN request header (sctp_strreset_inreq, 8 bytes). Generally, the IP payload is bounded to 65535 bytes, so the stream list cannot be large enough to trigger the overflow. However, on interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a stream list that fits within the incoming IN parameter can cause a __u16 overflow in sctp_make_strreset_req() when computing the OUT request size, leading to an undersized skb allocation and a kernel BUG:
net/core/skbuff.c:207 skb_panic net/core/skbuff.c:2625 skb_put net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req net/sctp/stream.c:655 sctp_process_strreset_inreq
The local setsockopt path validates the generated reset request size. However, for an incoming-only reset, it accounts for the smaller IN request even though the peer must generate an OUT request with the same stream list. Such a request cannot be completed successfully by the peer.
Reject peer IN requests whose corresponding OUT request would exceed SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an IN request that would require an oversized OUT request from the peer.
Linux >= 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 < 61327d8e7cfb0259d527be17202630f556213249Linux >= 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 < 7cf7439948e3bf639119119922c88ec190874ca3Linux >= 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 < 60c47dea5d320d2fc706e9aad1db38a04df0a056Linux >= 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 < b255d8cd6cc68045ae9eecbac3b3c14e1f176c9bLinux >= 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 < 6f0e39d180cd7cced647381b6fa14fd83d261047Linux >= 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 < 1a10fe1aa9c01f41b389a31906a77d538637c9d9Linux >= 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 < 00ae679cb21a035491fdad8d58dc6d79cc68b675Linux >= 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 < 18ae07691d43183d270de8be9dc8e027906015d9Linux 4.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets