Skip to main content

Linux Kernel CVE-2026-68320

| EUVDEUVD-2026-55421 HIGH
2026-08-10 Linux GHSA-f7gm-j66v-p95w
Buffer Overflow Linux
7.3
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
vuln.today AI
7.3 HIGH

Local socket API access requires only low privileges; 4-byte kernel memory overflow yields high integrity and availability impact with minor potential for memory disclosure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:11 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.3 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:02 cve.org
HIGH 7.3
CVE Published
Aug 10, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, allowing it to hold up to 20 chunk entries (param_hdr.length up to 24). However, the copy destination asoc->c.auth_chunks in struct sctp_cookie is only SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16 chunks are added, sctp_association_init() memcpy overflows the destination by up to 4 bytes.

Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.

AnalysisAI

Heap buffer overflow in the Linux kernel's SCTP authentication subsystem allows a local low-privileged user to corrupt kernel memory by adding more than 16 authentication chunk types to an SCTP endpoint. The capacity mismatch between sctp_auth_ep_add_chunkid()'s limit of SCTP_NUM_CHUNK_TYPES (20 entries) and the destination struct sctp_cookie's SCTP_AUTH_MAX_CHUNKS (16 entries) causes sctp_association_init() to memcpy up to 4 bytes past the auth_chunks buffer boundary. No public exploit has been identified at time of analysis and EPSS sits at the 6th percentile, but the kernel-space memory corruption potential and CVSS score of 7.3 warrant timely patching on any system where untrusted local users have shell access.

Technical ContextAI

The vulnerability resides in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem, governed by RFC 4895, which allows endpoints to negotiate which chunk types require HMAC-based authentication. The function sctp_auth_ep_add_chunkid() maintains an endpoint-level auth_chunk_list and enforces a capacity ceiling using the constant SCTP_NUM_CHUNK_TYPES (20 entries, yielding a param_hdr.length up to 24 bytes). However, during association initialization, sctp_association_init() copies this list into asoc->c.auth_chunks within struct sctp_cookie, which is statically sized for only SCTP_AUTH_MAX_CHUNKS (16 entries, 20 bytes). The constant mismatch allows up to 4 extra chunk entries to be added, causing a memcpy to overflow the destination buffer by up to 4 bytes into adjacent kernel memory. The fix narrows the capacity check in sctp_auth_ep_add_chunkid() to SCTP_AUTH_MAX_CHUNKS, aligning the source limit with the destination capacity. CPE data identifies the affected product as cpe:2.3:a:linux:linux:* broadly, with the vulnerability traced to the introduction commit 1f485649f52929d9937b346a920a522a7363e202 present since Linux 2.6.24. CWE classification is not assigned in the source data, but the root cause class is clearly a buffer overflow arising from an off-by-one capacity constant mismatch.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel: 6.6.148 or later for the 6.6.x stable series, 6.12.101 or later for the 6.12.x series, 6.18.42 or later for the 6.18.x series, or 7.1.6 or later for the 7.x series. Upstream fix commits are available at https://git.kernel.org/stable/c/5a365f1e423444c5da7eb689a8661633dad43e48, https://git.kernel.org/stable/c/886e28e14ab655012779016d251fef53d103aa12, https://git.kernel.org/stable/c/11092d79eb2b7c0068382f72fc2416d1786bb2e0, https://git.kernel.org/stable/c/b6ea3dda09eb4d5caf7bbc00f857688cf9e98255, and https://git.kernel.org/stable/c/ff04b26794a16a8a879eb4fd2c02c2d6b03850e9. Where immediate kernel patching is not operationally feasible, a compensating control is to disable the SCTP kernel module entirely by adding 'install sctp /bin/false' to /etc/modprobe.d/sctp-blacklist.conf and rebooting; note this will break any SCTP-dependent applications including certain SS7 and VoIP signaling stacks. Alternatively, deploying network-layer firewall rules to drop SCTP traffic (protocol 132) limits exposure to network-adjacent exploitation paths, though the vulnerability is fundamentally local. Using seccomp profiles or user namespaces to restrict which processes can create SCTP sockets provides an additional granular control without disabling the protocol system-wide.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68320 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy