CVE-2026-68315: Linux Kernel SCTP Buffer Overflow Flaw

CVE-2026-68315 Overview

CVE-2026-68315 is a Linux kernel vulnerability in the Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in sctp_process_strreset_inreq(), which fails to validate stream counts when processing a RESET_IN_REQUEST from a peer. A crafted incoming request can trigger a __u16 integer overflow in sctp_make_strreset_req(), causing an undersized skb allocation and a kernel BUG in skb_put().

The issue is reachable over the network on interfaces with a Maximum Transmission Unit (MTU) greater than 65535 bytes, such as loopback or IPv6 jumbogram-capable links.

Critical Impact
A remote peer can trigger a kernel panic on an SCTP-enabled Linux host, resulting in denial of service against affected systems.

Affected Products

Linux kernel with SCTP support enabled
Distributions shipping vulnerable stable kernel branches prior to the fixing commits
Systems exposing SCTP endpoints on interfaces with MTU greater than 65535 bytes

Discovery Timeline

2026-08-10 - CVE-2026-68315 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68315

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-190] in the SCTP stream reset handling path of the Linux kernel. When an SCTP peer sends a RESET_IN_REQUEST chunk, sctp_process_strreset_inreq() derives the number of streams from the incoming parameter length. The kernel then constructs a corresponding RESET_OUT_REQUEST chunk to satisfy the peer's request.

The sctp_strreset_outreq header is 16 bytes, while the incoming sctp_strreset_inreq header is 8 bytes. Because the OUT header is 8 bytes larger than the IN header, a stream list that fits within the IN parameter can push the computed OUT chunk size past the 65535-byte boundary tracked by a __u16 counter in sctp_make_strreset_req(). The result is an integer overflow that leads to an undersized socket buffer (skb) allocation.

When the kernel then calls sctp_addto_chunk() to append the oversized payload, skb_put() detects the mismatch and triggers skb_panic at net/core/skbuff.c:207, halting the kernel.

Root Cause

The local setsockopt path already validated the generated reset request size, but only against the IN request size. For incoming-only resets, the check did not account for the fact that the peer must construct an OUT request that is 8 bytes larger per stream metadata block, allowing a request the local host cannot satisfy without overflow.

Attack Vector

An attacker with an established SCTP association, reachable over an interface whose MTU exceeds 65535 bytes (for example, loopback with IPv6 jumbograms), sends a RESET_IN_REQUEST containing a large stream list. The victim host attempts to build the corresponding RESET_OUT_REQUEST, the size computation overflows, skb_put() panics, and the kernel crashes. No authentication or user interaction is required beyond an active SCTP session with the target.

Detection Methods for CVE-2026-68315

Indicators of Compromise

Kernel panic messages referencing skb_panic, skb_put, sctp_addto_chunk, sctp_make_strreset_req, or sctp_process_strreset_inreq in dmesg or /var/log/kern.log
Unexpected host reboots or SCTP service disruption on systems using interfaces with MTU greater than 65535 bytes
Anomalous inbound SCTP RE_CONFIG chunks carrying large stream reset parameters

Detection Strategies

Monitor kernel logs for panic signatures matching the SCTP stream reset call stack.
Inspect SCTP traffic for RESET_IN_REQUEST parameters whose length approaches the IP payload boundary.
Alert on repeated crashes of SCTP-enabled services (for example, telecom signaling gateways) that correlate with peer resets.

Monitoring Recommendations

Forward dmesg and syslog kernel facility events to a centralized data lake for retention and correlation.
Track interfaces configured with MTU greater than 65535 and inventory hosts exposing SCTP endpoints on those interfaces.
Baseline SCTP peer behavior and alert on unexpected RE_CONFIG chunk volumes or malformed stream reset parameters.

How to Mitigate CVE-2026-68315

Immediate Actions Required

Update to a Linux kernel that includes the upstream fix for sctp_process_strreset_inreq() size validation.
Audit hosts for loaded sctp modules and disable SCTP where the protocol is not required.
On systems that must run SCTP, restrict peer reachability to trusted networks and lower MTU below 65535 where operationally feasible.

Patch Information

The fix rejects peer IN requests whose corresponding OUT request would exceed SCTP_MAX_CHUNK_LEN and tightens the local check so the kernel will not send an IN request that would require an oversized OUT request from the peer. The patch is available in the following upstream commits: 00ae679cb21a, 18ae07691d43, 1a10fe1aa9c0, 6f0e39d180cd, and b255d8cd6cc6.

Workarounds

Blacklist the sctp kernel module on hosts that do not require SCTP, using install sctp /bin/true in /etc/modprobe.d/.
Reduce interface MTU to 65535 or below where operationally safe, eliminating the jumbogram condition required to reach the overflow.
Apply firewall rules restricting inbound SCTP (IP protocol 132) to known, trusted peer addresses.

bash

# Configuration example: disable SCTP module loading
echo 'install sctp /bin/true' | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep sctp