Skip to main content

Linux Kernel CVE-2026-68300

| EUVDEUVD-2026-55401 CRITICAL
2026-08-10 Linux GHSA-438p-hr89-q323
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Remote and unauthenticated (that is the bypass), but requires a non-default AUTH-required SCTP config plus specific chunk ordering or an skb_clone race, so AC:H; impact is primarily integrity (accepting unauthenticated chunks), hence I:H with lower C/A.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:06 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
9.8 (CRITICAL)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:02 cve.org
CRITICAL 9.8
CVE Published
Aug 10, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sctp: auth: verify auth requirement when auth_chunk is NULL

sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, silently skipping authentication. This is incorrect when:

  1. skb_clone() failed in the BH receive path, leaving auth_chunk

NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new connections, so the early sctp_auth_recv_cid() check cannot catch this.

  1. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never

called and auth_chunk remains NULL.

Fix by checking sctp_auth_recv_cid() when auth_chunk is NULL: if authentication is required, return false to drop the chunk; otherwise continue normally.

AnalysisAI

Authentication bypass in the Linux kernel SCTP stack allows the AUTH requirement to be silently skipped: sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL. On endpoints configured to require SCTP AUTH, a remote peer can get COOKIE-ECHO (and associated control chunks) processed without the mandated authentication, either by omitting the preceding AUTH chunk or by exploiting a receive-path skb_clone() failure. The fix rechecks sctp_auth_recv_cid() and drops the chunk when authentication is required. No public exploit identified at time of analysis; EPSS is low (0.20%).

Technical ContextAI

The affected component is the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically its RFC 4895 AUTH extension used to authenticate selected control/data chunks via a shared HMAC. In sctp_endpoint_bh_rcv(), incoming packets for new associations are processed while asoc is still NULL, so the early sctp_auth_recv_cid() gate cannot evaluate whether AUTH is required. The verification helper sctp_auth_chunk_verify() short-circuited to 'verified' whenever chunk->auth_chunk was NULL - a state reached either when no AUTH chunk precedes COOKIE-ECHO (skb_clone() never invoked) or when skb_clone() fails under memory pressure in the bottom-half receive path. The root cause is a missing-authentication / improper-verification logic flaw (CWE class akin to CWE-306/CWE-287); the CWE field was not populated (N/A) in the source data. CPE data identifies the affected product only generically as cpe:2.3:a:linux:linux:*, i.e. the mainline kernel, without pinning a version range in the CPE itself.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.148, 6.12.101, 6.18.42, or 7.1.6 (or 7.2-rc5 on the mainline release-candidate line), or your distribution's backported equivalent carrying the corresponding stable commits (ec2e157fc967, 28c5fdce9dd9, 18957373920c, 83f5031f2a6a, 8e04823c120b from git.kernel.org/stable). If immediate patching is not possible, the most effective compensating control is to eliminate the attack surface: blacklist/unload the sctp kernel module where SCTP is not required (echo 'install sctp /bin/true' via modprobe config), which fully removes exposure but breaks any SCTP-dependent application. Where SCTP is required, restrict reachability of SCTP listeners with netfilter/firewall rules (block SCTP protocol 132 from untrusted networks) so only trusted signaling peers can reach AUTH-protected endpoints - this reduces but does not remove risk for peers inside the trust boundary. Do not rely on SCTP AUTH as an enforced control on unpatched kernels, since that is precisely the mechanism being bypassed. Advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-68300.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68300 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy