CVE-2026-68320: Linux Kernel SCTP Buffer Overflow Flaw

CVE-2026-68320 Overview

CVE-2026-68320 is a heap buffer overflow in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in sctp_auth_ep_add_chunkid(), which enforces a capacity limit of SCTP_NUM_CHUNK_TYPES (20) on ep->auth_chunk_list. However, the destination buffer asoc->c.auth_chunks in struct sctp_cookie only holds SCTP_AUTH_MAX_CHUNKS (16) entries. When more than 16 chunk IDs are added, the subsequent memcpy in sctp_association_init() overflows the destination by up to four bytes.

Critical Impact
A local, low-privileged attacker can trigger heap memory corruption in kernel space, leading to integrity loss, denial of service, or potential privilege escalation.

Affected Products

Linux kernel (SCTP subsystem, net/sctp/auth.c)
Distributions shipping vulnerable stable kernel branches referenced in the upstream fix commits
Systems with SCTP loaded and reachable to local users

Discovery Timeline

2026-08-10 - CVE-2026-68320 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68320

Vulnerability Analysis

The vulnerability is a classic off-by-capacity heap buffer overflow [CWE-122] in the kernel's SCTP authentication chunk handling. The endpoint structure permits accumulating up to 20 chunk identifiers via sctp_auth_ep_add_chunkid(), gated by the SCTP_NUM_CHUNK_TYPES constant. During association initialization, the kernel copies this list into the association cookie's auth_chunks field, which is sized to SCTP_AUTH_MAX_CHUNKS (16 entries, 20 bytes total including header).

The capacity mismatch means the source can legitimately exceed the destination by four entries. The resulting memcpy writes up to four extra bytes past the cookie buffer, corrupting adjacent kernel heap memory. Exploitation requires local access and the ability to interact with SCTP endpoints, but no elevated privileges beyond those needed to open SCTP sockets.

Root Cause

The root cause is an inconsistent bounds constant between producer and consumer. sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES as its capacity guard, while the destination cookie field is sized against SCTP_AUTH_MAX_CHUNKS. The upstream fix replaces the guard constant in sctp_auth_ep_add_chunkid() with SCTP_AUTH_MAX_CHUNKS, aligning source enforcement to destination capacity.

Attack Vector

An attacker with local access opens an SCTP socket and configures authentication chunk IDs through the standard SCTP setsockopt interface. By adding more than 16 chunk IDs and triggering association initialization, the attacker forces the overflowing memcpy in sctp_association_init(). Because the corruption occurs in kernel heap memory adjacent to the cookie, deterministic heap grooming could allow controlled overwrite of neighboring structures. No verified public exploit is available at this time. See the upstream fix commit for the corrected bounds check.

Detection Methods for CVE-2026-68320

Indicators of Compromise

Unexpected kernel oops, slab corruption warnings, or KASAN reports referencing sctp_association_init or sctp_auth_ep_add_chunkid
Local processes invoking setsockopt with SCTP_AUTH_CHUNK repeatedly beyond 16 iterations on a single endpoint
Kernel logs containing SLUB or page allocator corruption messages correlated with SCTP socket activity

Detection Strategies

Enable KASAN or SLUB_DEBUG on test kernels to surface out-of-bounds writes in SCTP paths during fuzzing and integration testing
Audit running kernel versions against the fixed commits listed in the upstream references to identify unpatched hosts
Alert on unprivileged processes loading the sctp module or opening AF_INET/AF_INET6 sockets of type IPPROTO_SCTP on systems where SCTP is not required

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and alert on SCTP-related BUG, WARN, or KASAN entries
Track setsockopt telemetry via eBPF or auditd where feasible to identify repeated SCTP_AUTH_CHUNK configuration attempts
Baseline SCTP usage across the fleet; investigate hosts where SCTP is unexpectedly loaded

How to Mitigate CVE-2026-68320

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all affected stable branches
Where patching is delayed, blacklist the sctp kernel module on systems that do not require SCTP
Restrict local access on multi-tenant systems and enforce least privilege for interactive users

Patch Information

The fix replaces SCTP_NUM_CHUNK_TYPES with SCTP_AUTH_MAX_CHUNKS as the capacity limit in sctp_auth_ep_add_chunkid(). Vendor-supplied fixes are available in the following upstream commits: 11092d79eb2b, 5a365f1e4234, 886e28e14ab6, b6ea3dda09eb, and ff04b26794a1. Rebuild and reboot into patched kernels after applying distribution updates.

Workarounds

Disable SCTP by adding install sctp /bin/true to /etc/modprobe.d/disable-sctp.conf on hosts that do not require the protocol
Unload the module at runtime with rmmod sctp where no active SCTP sessions exist
Constrain the ability of unprivileged users to open raw or SCTP sockets using seccomp profiles or container security policies

bash

# Configuration example: block SCTP module load on systems that do not use SCTP
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo depmod -a
# Verify SCTP cannot be loaded
sudo modprobe sctp && echo "WARNING: sctp loaded" || echo "sctp load blocked"