{"id":"CVE-2026-68300","state":"PUBLISHED","title":"sctp: auth: verify auth requirement when auth_chunk is NULL","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: auth: verify auth requirement when auth_chunk is NULL\n\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk->auth_chunk is NULL, silently skipping authentication.\nThis is incorrect when:\n\n1. skb_clone() failed in the BH receive path, leaving auth_chunk\n   NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new\n   connections, so the early sctp_auth_recv_cid() check cannot\n   catch this.\n\n2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never\n   called and auth_chunk remains NULL.\n\nFix by checking sctp_auth_recv_cid() when auth_chunk is NULL:\nif authentication is required, return false to drop the chunk;\notherwise continue normally.","publishedAt":"2026-08-10T12:02:34.168Z","updatedAt":"2026-10-19T21:09:04.214Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"a129792b3aef15002746c13522781d92ed3522c3","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"5a022ac51ad83b4ce6c898f4b9eefc65bd26b247","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"6caf0e8590c0bf05a76b0d387726adf3a6f3725c","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"ec2e157fc9678a9bc411305a25aec3fd337d7efb","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"28c5fdce9dd955d2baf5e28987819b6d7cfaf646","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"18957373920caf5cdaf5cf32e5d1d7a99ca7700a","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"83f5031f2a6a49d696eb4cc0898345d12f9c6451","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"8e04823c120b376ef7dab14b60ebf6823aa16c14","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_statefuns.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.24","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.24","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_statefuns.c"]}],"references":["https://git.kernel.org/stable/c/a129792b3aef15002746c13522781d92ed3522c3","https://git.kernel.org/stable/c/5a022ac51ad83b4ce6c898f4b9eefc65bd26b247","https://git.kernel.org/stable/c/6caf0e8590c0bf05a76b0d387726adf3a6f3725c","https://git.kernel.org/stable/c/ec2e157fc9678a9bc411305a25aec3fd337d7efb","https://git.kernel.org/stable/c/28c5fdce9dd955d2baf5e28987819b6d7cfaf646","https://git.kernel.org/stable/c/18957373920caf5cdaf5cf32e5d1d7a99ca7700a","https://git.kernel.org/stable/c/83f5031f2a6a49d696eb4cc0898345d12f9c6451","https://git.kernel.org/stable/c/8e04823c120b376ef7dab14b60ebf6823aa16c14"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68300.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68300","state":"PUBLISHED","datePublished":"2026-08-10T12:02:34.168Z","dateUpdated":"2026-10-19T21:09:04.214Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.380Z"},"containers":{"cna":{"title":"sctp: auth: verify auth requirement when auth_chunk is NULL","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: auth: verify auth requirement when auth_chunk is NULL\n\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk->auth_chunk is NULL, silently skipping authentication.\nThis is incorrect when:\n\n1. skb_clone() failed in the BH receive path, leaving auth_chunk\n   NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new\n   connections, so the early sctp_auth_recv_cid() check cannot\n   catch this.\n\n2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never\n   called and auth_chunk remains NULL.\n\nFix by checking sctp_auth_recv_cid() when auth_chunk is NULL:\nif authentication is required, return false to drop the chunk;\notherwise continue normally."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"a129792b3aef15002746c13522781d92ed3522c3","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"5a022ac51ad83b4ce6c898f4b9eefc65bd26b247","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"6caf0e8590c0bf05a76b0d387726adf3a6f3725c","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"ec2e157fc9678a9bc411305a25aec3fd337d7efb","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"28c5fdce9dd955d2baf5e28987819b6d7cfaf646","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"18957373920caf5cdaf5cf32e5d1d7a99ca7700a","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"83f5031f2a6a49d696eb4cc0898345d12f9c6451","versionType":"git"},{"version":"bbd0d59809f923ea2b540cbd781b32110e249f6e","status":"affected","lessThan":"8e04823c120b376ef7dab14b60ebf6823aa16c14","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_statefuns.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.24","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.24","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_statefuns.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a129792b3aef15002746c13522781d92ed3522c3"},{"url":"https://git.kernel.org/stable/c/5a022ac51ad83b4ce6c898f4b9eefc65bd26b247"},{"url":"https://git.kernel.org/stable/c/6caf0e8590c0bf05a76b0d387726adf3a6f3725c"},{"url":"https://git.kernel.org/stable/c/ec2e157fc9678a9bc411305a25aec3fd337d7efb"},{"url":"https://git.kernel.org/stable/c/28c5fdce9dd955d2baf5e28987819b6d7cfaf646"},{"url":"https://git.kernel.org/stable/c/18957373920caf5cdaf5cf32e5d1d7a99ca7700a"},{"url":"https://git.kernel.org/stable/c/83f5031f2a6a49d696eb4cc0898345d12f9c6451"},{"url":"https://git.kernel.org/stable/c/8e04823c120b376ef7dab14b60ebf6823aa16c14"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is SCTP COOKIE-ECHO chunk processing in the kernel's SCTP state machine, reached directly from packets received on the network from any remote peer over an arbitrarily routed SCTP connection.\nAC:L - The attacker deterministically triggers the bypass by completing a normal INIT/INIT-ACK exchange with the AUTH extension advertised and then sending COOKIE-ECHO with no preceding AUTH chunk; no race, no memory-layout dependency, and every step is under the attacker's control.\nPR:N - This is the pre-authentication association-establishment path itself; the attacker needs no credentials, no shared SCTP-AUTH key, and no account, since the bug is precisely that the required authentication is skipped.\nUI:N - The listening SCTP endpoint processes the crafted COOKIE-ECHO automatically in the receive path; no action by any local user or administrator is needed.\nS:U - The bypass affects the SCTP association and the application relying on it within the same host security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An unauthenticated peer is admitted as an apparently authenticated one, and because peer.auth_capable is set the SCTP_AUTH_NO_AUTH notification is suppressed so the application cannot detect it, giving the attacker full read access to all data the service sends on that association.\nI:H - The attacker can inject arbitrary SCTP data and control chunks into the service as a trusted, supposedly key-verified peer, and can use the dupcook restart path to update or replace an existing association's state without authentication.\nA:H - Authenticating COOKIE-ECHO is the RFC 4895 defense against unauthorized association restart; bypassing it lets an attacker reset/take over an established association, dropping its queued state and denying service to the legitimate peer, and lets unauthorized peers consume association and accept-queue resources on an endpoint meant to admit only key-holding peers."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-19T16:32:51.209Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.24","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-68300","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:46:55.343274Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","lang":"en","type":"CWE","description":"CWE-287 Improper Authentication"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T21:09:04.214Z"}}]}}}